{{ message }}
Repository navigation
Escape the download error alert message for JavaScript - #43082
Open
ManoharPaturi wants to merge 1 commit into
Open
ManoharPaturi wants to merge 1 commit into
ManoharPaturi wants to merge 1 commit into
Conversation
|
Hello @ManoharPaturi! This is your first pull request on PrestaShop repository of the PrestaShop project. Thank you, and welcome to this Open Source community! |
ps-jarvis
added
Improvement
The message shown in the alert of the virtual product download error page was printed inside a JavaScript string literal without any escaping. A translation containing a double quote, a closing tag or a backslash broke the string and produced a syntax error on the page, and any markup placed in a translation was interpreted as script by the browser. The message and the redirect target are now encoded with json_encode using the hex flags, so quotes, angle brackets and ampersands survive any translation content.
ManoharPaturi
force-pushed
the
escape-download-error-alert
branch
from
October 4, 2026 02:39
ef05255 to
24c4b1b
Compare
Author
|
Thank you for the pointers. The pull request is now based on develop, the description table is filled in, and a matching issue has been opened and linked in the description. Please let me know if anything else is needed. |
Author
LameuleFR
approved these changes
Oct 20, 2026
Contributor
There was a problem hiding this comment.
LGTM, the JSON_HEX_* flags keep any translation inside the string literal and the <script> block.
Small thing: the description doesn't match the diff (the method is displayCustomError(), the alert used a double-quoted string, and Tools::displayError() isn't involved), worth fixing so the changelog is accurate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
In
GetFileControllerCore::displayError()the error message is embedded into the JavaScript alert of the error page throughTools::displayError()output that is placed inside a single quoted JavaScript string context in the template. A message containing a single quote, a backslash or a closing script tag breaks out of that string and can inject script into the page when a translation or an error text contains such characters.This change escapes the message for the JavaScript string context before it is passed to the template, so quotes, backslashes, angle brackets and line terminators are encoded and the message can never terminate the surrounding string or tag.
How to test
Trigger a download error (for example by requesting a file name that does not exist) and view the page source around the alert call: the message appears escaped. A message containing a single quote or a script tag renders inside the alert text instead of breaking the script context.
Verified with
php -land by rendering the error page with hostile message content under both the old and the new expression: the old output terminates the JavaScript string, the new output stays inside it.Fixes #43087