Description
When using Phalcon's Phalcon\Forms\Element\TextArea element, no escaping/htmlentities is done on the value in between the real <textarea> and </textarea> tags. A malicious user simply entering </textarea> into the form allows any following client-side code to be executed when returning to the form.
Example form with malicious user input:
Next time the form is rendered, the malicious code gets executed:
This behaviour is inconsistent with Phalcon\Forms\Element\Text which does safely convert special characters to HTML entities.
I'm using Phalcon 3.0.1 on Ubuntu 16.04 64bit with PHP 7.0.8-0ubuntu0.16.04.3 (standard official Ubuntu repo package at present).
This appears to be where the tag is generated, "content" isn't escaped: https://github.com/phalcon/cphalcon/blob/v3.0.1/phalcon/tag.zep#L963
In the meantime, you can work around this issue by using this extended element class (instead of using Phalcon\Forms\Element\TextArea directly)...
class TextAreaSafe extends \Phalcon\Forms\Element\TextArea
{
public function render($attributes = null)
{
$fieldName = $this->getName();
$Escaper = new \Phalcon\Escaper();
$this->getForm()->getEntity()->$fieldName = $Escaper->escapeHtml($this->getValue());
return parent::render($attributes);
}
}