Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor

@@ -221,7 +221,7 @@
           expect(page).to have_content("Organization updated successfully")
           expect(find(
             "#organization-admin_terms_of_use_body-tabs-admin_terms_of_use_body-panel-0 .editor .ql-editor"
-          )["innerHTML"]).to eq("<p>bar baz</p>")
+          )["innerHTML"]).to eq("<p>bar baz</p><p><br></p>")
         end
       end
 
@@ -468,6 +468,31 @@
           )
         end
       end
+
+      context "when adding malformed content" do
+        let(:organization) { create(:organization, admin_terms_of_use_body: {}) }
+
+        it "does not saves it" do
+          WebMock.stub_request(:get, "http://example.org/x").to_return(status: 404)
+
+          accept_alert do
+            page.execute_script(
+              <<~JS
+                var element = document.querySelector("#organization-admin_terms_of_use_body-tabs-admin_terms_of_use_body-panel-0 div[contenteditable='true'].ql-editor");
+                element.innerHTML = "testing <img src='http://example.org/x' onerror=alert(1) >";
+              JS
+            )
+          end
+
+          click_button "Update"
+
+          sleep 1
+
+          expect(find(
+            "#organization-admin_terms_of_use_body-tabs-admin_terms_of_use_body-panel-0 .editor .ql-editor"
+          )["innerHTML"]).to eq("<p>testing</p><p><img src=\"http://example.org/x\"></p>")
+        end
+      end
     end
   end
 

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "foundation_rails_helper/form_builder"
+require_relative "../../app/helpers/decidim/sanitize_helper"
 
 module Decidim
   # This custom FormBuilder adds fields needed to deal with translatable fields,
@@ -9,6 +10,7 @@ class FormBuilder < FoundationRailsHelper::FormBuilder
     include ActionView::Context
     include Decidim::TranslatableAttributes
     include Decidim::Map::Autocomplete::FormBuilder
+    include Decidim::SanitizeHelper
 
     # Public: generates a check boxes input from a collection and adds help
     # text and errors.
@@ -192,11 +194,12 @@ def editor(name, options = {})
       options.delete(:required)
       hashtaggable = options.delete(:hashtaggable)
       hidden_options = extract_validations(name, options).merge(options)
+      sanitized_value = sanitize_editor_value(object.send(name))
 
       content_tag(:div, class: "editor #{"hashtags__container" if hashtaggable}") do
         template = ""
         template += label(name, label_text + required_for_attribute(name)) if options.fetch(:label, true)
-        template += hidden_field(name, hidden_options)
+        template += hidden_field(name, hidden_options.merge(value: sanitized_value))
         template += content_tag(:div, nil, class: "editor-container #{"js-hashtags" if hashtaggable}", data: {
                                   toolbar: toolbar,
                                   disabled: options[:disabled],
@@ -941,5 +944,14 @@ def resource_class(attribute)
 
       object.class
     end
+
+    # Private: Sanitize editor values to prevent malformed values being display in the
+    # WYSIWYG editor
+    #
+    def sanitize_editor_value(value)
+      sanitized_value = decidim_sanitize_editor_admin(value)
+
+      sanitized_value == %(<div class="ql-editor-display"></div>) ? "" : sanitized_value
+    end
   end
 end