Open
Description
Preconditions and environment
User input value such as {{var firstname}} is parsed in Address Book.
- Magento version: 2.4.3 ~ 2.4.7
- Reproduce: see images below
- It seems there are no security/performance/info leak issues
Steps to reproduce
Magento 2.4.7 + use the system default HTML Address Template
Company: {{if city}}{{var city}}, {{/if}}
Street Address(street1): {{var firstname}}{{var lastname}}{{var country}}
Expected result
The displayed address should be what the customer input.
{{something}} should not be parsed.
Actual result
Customer input got parsed.
Additional information
The cause is this line Template.php#L317.
str_replace is dangerous when you don't know what will be replaced, how many times the original string will be modified.
The best way is to sanitize the user input. The "deferred directives" may not be reliable because you still cannot control the user input value.
Release note
No response
Triage and priority
- Severity: S0 - Affects critical data or functionality and leaves users without workaround.
- Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
- Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
- Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
- Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.
Activity