diff --git a/lib/internal/Magento/Framework/Test/Unit/Validator/HTML/ConfigurableWYSIWYGValidatorTest.php b/lib/internal/Magento/Framework/Test/Unit/Validator/HTML/ConfigurableWYSIWYGValidatorTest.php index cbc8b27bd2eeb..38dced3daf9b8 100644 --- a/lib/internal/Magento/Framework/Test/Unit/Validator/HTML/ConfigurableWYSIWYGValidatorTest.php +++ b/lib/internal/Magento/Framework/Test/Unit/Validator/HTML/ConfigurableWYSIWYGValidatorTest.php @@ -166,6 +166,15 @@ public static function getConfigurations(): array [], ['div' => ['src' => false]] ], + 'valid-allowed-tag-with-script-in-class-name' => [ + ['div'], + ['class', 'src'], + [], + '
this is a product description
', + true, + [], + ['div' => ['src' => false]] + ], 'invalid-allowed-tag-attributes' => [ ['a'], ['href'], diff --git a/lib/internal/Magento/Framework/Validator/HTML/ConfigurableWYSIWYGValidator.php b/lib/internal/Magento/Framework/Validator/HTML/ConfigurableWYSIWYGValidator.php index b1009b946c6a3..bf4e9567e1273 100644 --- a/lib/internal/Magento/Framework/Validator/HTML/ConfigurableWYSIWYGValidator.php +++ b/lib/internal/Magento/Framework/Validator/HTML/ConfigurableWYSIWYGValidator.php @@ -19,7 +19,7 @@ class ConfigurableWYSIWYGValidator implements WYSIWYGValidatorInterface * @var string */ private static string $xssFiltrationPattern = - '/((javascript(\\\\x3a|:|%3A))|(data(\\\\x3a|:|%3A))|(vbscript:)|(script)|(alert\())|' + '/((javascript(\\\\x3a|:|%3A))|(data(\\\\x3a|:|%3A))|(vbscript:)|(script\b)|(alert\())|' . '((\\\\x6A\\\\x61\\\\x76\\\\x61\\\\x73\\\\x63\\\\x72\\\\x69\\\\x70\\\\x74(\\\\x3a|:|%3A))|' . '(\\\\x64\\\\x61\\\\x74\\\\x61(\\\\x3a|:|%3A)))/i';