Upgrading to 1.3.23

Hyvä Theme 1.3.23 is a security maintenance release for the 1.3.x series. It backports a cross-site scripting fix in the MSRP templates for users who are not yet ready to upgrade to 1.4.

There are no breaking changes and no new features.

Security fix

Cross-site scripting in the MSRP templates

Both MSRP templates escaped values for HTML while rendering them into JavaScript. In the price template this allowed a crafted product name to break out of the string and run script on the storefront, because the browser decodes the HTML entities in the x-data attribute before Alpine evaluates it. In the popup template the HTML escaping of the MSRP explanation messages prevented a break-out, but a crafted message could still break the popup script. Both templates now escape these values for JavaScript.

The issue is rated low severity, because exploiting it requires write access to product data. For details, see the Security Changelog.

Backward compatibility

This release is backward compatible.

If your theme overrides Magento_Msrp/templates/popup.phtml or Magento_Msrp/templates/product/price/msrp.phtml, the override does not receive the fix. Apply the same change to your copy:

• In msrp.phtml, use escapeJs instead of escapeHtml for the product id and name.
• In popup.phtml, keep the existing escapeHtml(..., ["br"]) on the explanation messages and wrap its result in escapeJs.

See merge request #1550 for the exact change.

Changelogs

Changelogs are available from the CHANGELOG.md in the codebase, or here:

• Changelog Default Theme
• Changelog Theme Module

Tooling

Please refer to the Hyvä Theme upgrade docs for helpful information on how to upgrade.