Merge pull request #232 from alma/feature/ecom-1474-woocommerce-xss-s…

…ecurity-issue

XSS security issue in shortcode widget

CHANGELOG.md

@@ -1,6 +1,10 @@
 Changelog
 =========
 
+v5.2.1
+------
+* fix: shortcode widget for XSS injection
+
 v5.2.0
 ------
 * feature : HPOS compatibility

README.md

@@ -7,7 +7,7 @@
 - Tested up to Wordpress: 6.3.2
 - Tested up to Woocommerce: 8.2.1
 - Requires PHP: 5.6
-- Stable tag: 5.2.0
+- Stable tag: 5.2.1
 - License: GPLv3
 - License URI: https://www.gnu.org/licenses/gpl-3.0.html
 - Support: [email protected]

readme.txt

@@ -5,7 +5,7 @@ Tags: payments, BNPL, woocommerce, ecommerce, e-commerce, payment gateway, sell,
 Requires at least: 4.4
 Tested up to: 6.3
 Requires PHP: 5.6
-Stable tag: 5.2.0
+Stable tag: 5.2.1
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -51,6 +51,9 @@ You can find more documentation on our [website](https://docs.almapay.com/docs/w
 
 == Changelog ==
 
+= 5.2.1 =
+* fix: shortcode widget for XSS injection
+
 = 5.2.0 =
 * feat: Update translations
 * fix: widget XSS

src/alma-gateway-for-woocommerce.php

@@ -3,7 +3,7 @@
  * Plugin Name: Alma - Pay in installments or later for WooCommerce
  * Plugin URI: https://docs.almapay.com/docs/woocommerce
  * Description: Install Alma and boost your sales! It's simple and guaranteed, your cash flow is secured. 0 commitment, 0 subscription, 0 risk.
- * Version: 5.2.0
+ * Version: 5.2.1
  * Author: Alma
  * Author URI: https://almapay.com
  * License: GNU General Public License v3.0
@@ -38,7 +38,7 @@
 }
 
 if ( ! defined( 'ALMA_VERSION' ) ) {
-	define( 'ALMA_VERSION', '5.2.0' );
+	define( 'ALMA_VERSION', '5.2.1' );
 }
 if ( ! defined( 'ALMA_PLUGIN_FILE' ) ) {
 	define( 'ALMA_PLUGIN_FILE', __FILE__ );

src/includes/class-alma-shortcodes.php

@@ -100,7 +100,7 @@ protected function is_debug( $atts ) {
 	 * @return string the rendered eligibility widget to inject
 	 */
 	protected function render( $shortcode_tag, $atts, $alma_content, $shortcode_content = '' ) {
-		$class         = isset( $atts['class'] ) ? $atts['class'] : '';
+		$class         = isset( $atts['class'] ) ? htmlspecialchars($atts['class']) : '';
 		$style         = '';
 		$debug_content = '';
 		if ( $this->is_debug( $atts ) ) {
@@ -110,7 +110,15 @@ protected function render( $shortcode_tag, $atts, $alma_content, $shortcode_cont
 			$debug_content = sprintf( '<div style="%s">%s</div>', $style_title, $shortcode_tag );
 		}
 
-		return sprintf( '<div class="%s %s" style="%s">%s<div class="alma_wc_content">%s</div>%s</div>', $shortcode_tag, $class, $style, $debug_content, do_shortcode( $shortcode_content ), $alma_content );
+		return sprintf(
+            '<div class="%s %s" style="%s">%s<div class="alma_wc_content">%s</div>%s</div>',
+            $shortcode_tag,
+            $class,
+            $style,
+            $debug_content,
+            do_shortcode( $shortcode_content ),
+            $alma_content
+        );
 
 	}