View online: https://www.drupal.org/sa-contrib-2020-002

Project: SpamSpan filter [1] Date: 2020-January-22 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting

Description:  The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.

This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.

This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.

Solution:  Install the latest version:

* If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 8.x-1.1 [3]

Also see the SpamSpan filter [4] project page.

Reported By:  * Jeroen Tubex [5]

Fixed By:  * Jeroen Tubex [6] * vitalie [7]

Coordinated By:  * Ben Jeavons [8] of the Drupal Security Team

[1] https://www.drupal.org/project/spamspan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamspan/releases/8.x-1.1 [4] https://www.drupal.org/project/spamspan [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/175134 [8] https://www.drupal.org/u/coltrane