GHSA-5r6x-g6jv-4v87: Ibexa Admin UI XSS vulnerabilities in back office

The vulnerability lies in multiple JavaScript components within the Ibexa Admin UI's back office where user-controllable data (such as item names, labels, search terms, content metadata) was incorporated into HTML strings or directly manipulated in the DOM without proper sanitization. This occurred typically through direct string concatenation into templates, direct assignment to innerHTML, or usage of insertAdjacentHTML with unescaped content. An attacker with sufficient permissions (e.g., Editor, Administrator) could inject malicious scripts (XSS) by crafting input that would then be rendered by these vulnerable functions. The injected XSS could be persistent and potentially affect front-office users.

The patches address these issues by consistently applying HTML escaping functions (e.g., escapeHTML for general content, escapeHTMLAttribute for attribute values) to sanitize the data before it's used in HTML contexts. Additionally, helper functions like dangerouslyInsertAdjacentHTML, dangerouslySetInnerHTML, and dangerouslyAppend are employed. These functions, when used correctly, signal that the input string is already sanitized or is intentionally HTML, thus making the code's intent clearer and safer when combined with prior escaping of dynamic data.