[security] GHSA-h78x-47qg-qjmq: Escape output and sanitize href in DataObject Data\Link::getHtml

[pimcore-deployments]

Advisory: GHSA-h78x-47qg-qjmq

Vulnerability

Pimcore\Model\DataObject\Data\Link::getHtml() (and __toString()) concatenated href, the named attributes (title, class, rel, target, tabindex, accesskey) and the free-form attributes string directly into the <a> tag without escaping — only the link text went through htmlspecialchars(). The URI scheme of href was never validated either. Since this data type is populated from editor/end-user input, a stored value could:

• break out of an attribute value (" in href/title/class) to inject arbitrary markup or event handlers,
• use a javascript: URI so the link executes script on click,
• inject event-handler attributes (e.g. onclick=...) or break out of the tag via the free-form attributes string.

This is the DataObject sibling of GHSA-97cp-8873-v2gf (Document Link XSS) and uses the same mitigation approach as the Document Link editable fix in #19392 (GHSA-9g27-c28m-8xg5).

Fix

The mitigation is opt-in on this release line. It reuses the Pimcore\Model\Document\Editable\Link\AttributeSanitizer policy class from #19392, but is enabled by its own, independent config (so DataObject links and Document links can be switched separately):

pimcore:
    objects:
        link_sanitizer:
            strict: true
            # optional, only used while strict is true:
            blocked_url_schemes: ['javascript:', 'vbscript:']   # default; entries are validated
            block_unsafe_data_urls: true                        # default

With strict: true, getHtml():

• renders an empty href for javascript:/vbscript: (and the configured schemes) and for script-capable data: URLs (data:text/html, data:image/svg+xml, ...); whitespace/control-character and character-reference obfuscation (java\tscript:, javascript:) is covered by the shared policy,
• parses the free-form attributes string into name/value pairs and re-serializes it: event-handler names (on*) and tokens that are not shaped like an attribute are dropped, values are HTML-escaped (without double-encoding existing character references). This closes tag injection such as data-x=""><script>... and is linear in the input size.

Always on, independent of the policy: " in href and in the named attributes is escaped as ", since it is the only character that can end the double-quoted attribute value.

PimcoreCoreBundle::boot() installs the configured policy into the new Pimcore\Model\DataObject\Data\Link\SanitizerPolicy holder (and shutdown() resets it); an application can install its own via SanitizerPolicy::setInstance(), which is never overridden by the config. A small accessor AttributeSanitizer::rejectsEditorSuppliedAttributeKeys() was added for the attribute handling.

Backward compatibility

Checked against pimcore-backward-compatibility. Everything that removes existing behavior is behind strict, which defaults to false:

• Default: the advisory is not closed. An editor can still store a javascript: link or an event-handler attribute until the site sets pimcore.objects.link_sanitizer.strict: true. While running on the permissive default, every render the strict policy would reject triggers Since pimcore/pimcore 2026.3: ... will be removed in 2027.1 (once per rejected href and once per rendering with rejected free-form attributes), where strict becomes the default. A policy installed explicitly via SanitizerPolicy::setInstance() opts out of the deprecation.
• getHref(), getAttributes() and all other public getters/setters are unchanged, as are signatures, return types and stored data.
• On the permissive default, getHtml() output is byte-identical to 2026.3 for every input that did not contain a " in href or in one of the named attributes (entities such as &, single-quoted or oddly spaced free-form attributes included). The only unconditional difference: a " in those values is rendered as " instead of breaking out of the attribute.
• With strict: true the output intentionally changes for the inputs listed above: rejected URLs render href="", and free-form attributes are re-serialized (double quotes, normalized whitespace, dropped event handlers and tokens that do not parse as attributes, e.g. names outside [A-Za-z_:][-A-Za-z0-9_:.]* such as @click, or unquoted values containing =, quotes or angle brackets).
• New: config keys pimcore.objects.link_sanitizer.{strict,blocked_url_schemes,block_unsafe_data_urls}, SanitizerPolicy, AttributeSanitizer::rejectsEditorSuppliedAttributeKeys(), PimcoreCoreBundle::boot()/shutdown() handling (the bundle is @internal), and a dependency of the DataObject Link on the Document AttributeSanitizer policy class. The Document Link setting is untouched.

Documented in doc/01_Documents/02_Templates/03_Editables/18_Link.md ("DataObject Link data type").

Testing

Tests: tests/Unit/Models/DataObject/Data/LinkSanitizerTest.php, plus config/boot coverage in tests/Unit/Bundle/CoreBundle/DependencyInjection/LinkSanitizerConfigurationTest.php and tests/Unit/Bundle/CoreBundle/PimcoreCoreBundleLinkSanitizerTest.php (independence from the Document setting, boot order, shutdown reset) — permissive default (byte-identical benign output, " escaping, deprecations, explicit-policy opt-out) and strict policy (unsafe href forms incl. obfuscation and data: URLs, event-handler stripping, tag injection, quoted values with </>/entities, long-whitespace input). The assertions were additionally run against the changed classes with the project autoloader outside PHPUnit; CI is the source of truth for the full suite.

Security-Advisory: pimcore/platform-version/GHSA-h78x-47qg-qjmq

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Draft a security-advisory fix · claude · sonnet50 · 280 AIC · ⌖ 23.2 AIC · ⊞ 7.6K · ◷

[github-actions]

Review Checklist

• Target branch (2026.2 for bug fixes, others 2026.x)
• Tests (if it's testable code, there should be a test for it - get help)
• Docs (every functionality needs to be documented, see here)
• Migration incl. install.sql (e.g. if the database schema changes, ...)
• Upgrade notes (deprecations, important information, migration hints, ...)
• Label
• Milestone

[Copilot]

Copilot review overview

🟡 Changes recommended

Free-form attributes still permit arbitrary element injection, and one regression test does not verify its intended behavior.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Regex filtering permits raw HTML and script tag injection · New
• Assertion misses obfuscated javascript scheme vulnerability · New

What changed in this PR

Verdict: Needs changes. The PR hardens DataObject link rendering against stored XSS.

Changes:

• Escapes named anchor attributes and sanitizes executable URI schemes.
• Filters event handlers from free-form attributes.
• Adds regression tests for escaping and sanitization.

The output boundary is appropriate and covers getHtml()/__toString(), but raw attributes still permit tag injection at Link.php:458. The obfuscated-scheme test at LinkTest.php:236 also passes before the fix. Public signatures remain compatible; no documentation was changed.

File	Description
models/​DataObject/​Data/​Link.php	Escapes and sanitizes generated anchor markup.
tests/​Model/​DataType/​LinkTest.php	Adds security regression tests.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The sanitizer drops valid quoted values, double-encodes existing entities, and relies on an inaccurate compatibility assessment.

Review effort: Balanced
Findings: 1

Open (1)

• Allow angle brackets in quoted HTML attribute values · New

Resolved since last review (2)

• Regex filtering permits raw HTML and script tag injection
• Assertion misses obfuscated javascript scheme vulnerability

Previously missed (1)

In code that hasn't changed since last review

Correct inaccurate byte-for-byte compatibility claim

models/​DataObject/​Data/​Link.php:426

The backward-compatibility claim that unaffected inputs remain byte-for-byte identical is incorrect: a normal URL such as https://example.test/?a=1&b=2 contains none of the listed dangerous input but now renders with &. Escaping is appropriate, but the PR description should distinguish equivalent rendered behavior from identical serialized output so the compatibility assessment is accurate.

[Copilot]

Copilot review overview

🟡 Changes recommended

Free-form entities are double-encoded, the stated compatibility guarantee is inaccurate, and direct href escaping lacks regression coverage.

Review effort: Balanced
Findings: 1

Open (1)

• Preserve free-form attribute syntax or revise compatibility claims · New

Resolved since last review (1)

• Allow angle brackets in quoted HTML attribute values

Previously missed (2)

In code that hasn't changed since last review

Avoid double-encoding existing HTML entities

models/​DataObject/​Data/​Link.php:482

This re-escapes entity references that are already valid markup in the free-form attribute string. For example, data-label="Tom " Jerry" becomes data-label="Tom " Jerry", so the DOM value changes from Tom " Jerry to the literal text Tom " Jerry. Preserve recognized entities while still escaping raw metacharacters by disabling double encoding.

Add independent href quote-escaping regression coverage

models/​DataObject/​Data/​Link.php:426

The new href escaping is not covered independently: the added attribute-escaping tests exercise only title and class, while the scheme tests contain no quote that could break out of href. Add a direct URL containing " and assert that it is encoded and cannot create a second attribute, so a regression on this security boundary is caught.

[Copilot]

Copilot review overview

🟡 Changes recommended

The malformed-attribute recovery loop can impose substantial CPU cost on rendering crafted stored values.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve free-form attribute syntax or revise compatibility claims
• Update compatibility assessment for intentional attribute escaping changes · New

Previously missed (1)

In code that hasn't changed since last review

Whitespace recovery rescans long runs, causing render-time CPU spikes

models/​DataObject/​Data/​Link.php:473

The recovery path advances to the whitespace itself, so a long whitespace run before an invalid token is rescanned once per byte. A self-contained benchmark of this exact loop grew from 0.9 ms at 1 KB to 16 ms at 8 KB; because this field is stored as TEXT and has no setter limit, crafted stored attributes can add substantial CPU cost to every render. Jump directly to the next non-whitespace token (or drop the remainder) instead.

[Copilot]

Copilot review overview

🟡 Changes recommended

Script-capable data URLs remain allowed, and the backward-compatibility assessment does not match the implemented normalization.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

• Reject script-capable data URLs in link attributes · New
• Preserve free-form attribute syntax or revise compatibility claims
• Update compatibility assessment for intentional attribute escaping changes

[Copilot]

Copilot review overview

🔵 Needs a closer look

The implementation contradicts its stated backward-compatibility basis by altering benign serialized HTML output.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve free-form attribute syntax or revise compatibility claims
• Update compatibility assessment for intentional attribute escaping changes

Resolved since last review (1)

• Reject script-capable data URLs in link attributes

[Copilot]

Copilot review overview

🔵 Needs a closer look

The broader output compatibility change must be accurately assessed and documented before approval.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve free-form attribute syntax or revise compatibility claims
• Update compatibility assessment for intentional attribute escaping changes

[Copilot]

Copilot review overview

🔵 Needs a closer look

Security-sensitive HTML parsing requires maintainer validation, and the duplicated configuration schema remains unresolved.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve free-form attribute syntax or revise compatibility claims
• Extract shared sanitizer schema to prevent inconsistent security policies · New

Resolved since last review (1)

• Update compatibility assessment for intentional attribute escaping changes

[Copilot]

Copilot review overview

🔵 Needs a closer look

The security-critical URL and HTML parsing behavior warrants final maintainer security validation.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Preserve free-form attribute syntax or revise compatibility claims
• Extract shared sanitizer schema to prevent inconsistent security policies