[solidus_frontend] [GHSA-87gm-56c6-255g] Stored cross-site scripting in Solidus Frontend order details

[Jared Norman]

Versions Affected: All versions of solidus_frontend (<= 4.7.1), including releases published from the Solidus monorepo before the gem moved to its own repository
Not affected: NONE
Fixed Versions: 4.7.2, 4.6.4

Impact
------

Stored cross-site scripting (XSS) in the order details shown by
solidus_frontend. The `Spree::OrdersHelper#truncated_product_description`
helper renders `Spree::Product#description` as raw, unescaped HTML:

    def truncated_product_description(product)
      truncate_html(raw(product.description))
    end

The helper is used by the `spree/shared/_order_details` partial, which is
rendered on the checkout confirmation step and on the order page. HTML stored
in a description, such as `<img src=x onerror=...>`, executes in the browser
of every customer who reaches either page with that product in their order,
including guests following a tokenized order link. Truncation does not help:
`truncate_html` shortens the text but passes markup through unchanged.

Planting a payload requires a back-office account with product-management or
superuser permissions (customers cannot). But the script then runs in the
session of the customer viewing their order, where it can make same-origin
requests on their behalf, such as changing the account email to take over the
account through a password reset.

This is the same underlying issue as GHSA-x943-j5hw-mr2w in `solidus_core`,
but in a separate helper that lives in solidus_frontend. Upgrading
`solidus_core` alone does not fix it.

All released versions of solidus_frontend contain this code, including the
releases published from the Solidus monorepo before the gem moved to its own
repository.

Patches
-------

The vulnerability is fixed in solidus_frontend 4.7.2 and 4.6.4. Upgrade to one
of those versions. The helper now sanitizes the description with the Rails
allowlist sanitizer (stripping scripts and event handlers while preserving
basic formatting) before truncating it. As in `solidus_core`, stores that have
opted in with `Spree::Config.show_raw_product_description = true` continue to
get the raw description.

Stores should also upgrade `solidus_core` to 4.7.2 or 4.6.4 to fix the product
page.

Although solidus_frontend is deprecated in favor of the starter storefront,
security fixes are still provided for it.

Workarounds
-----------

Stores that cannot upgrade immediately can add an initializer that redefines
the helper to sanitize its output:

    # config/initializers/sanitize_truncated_product_description.rb
    Rails.application.config.to_prepare do
      Spree::OrdersHelper.module_eval do
        def truncated_product_description(product)
          if Spree::Config.show_raw_product_description
            truncate_html(raw(product.description))
          else
            truncate_html(sanitize(product.description))
          end
        end
      end
    end

This stops payloads from executing but does not clean existing data — audit
`spree_products.description` for injected markup and remove it, and limit
product-management access to trusted staff.

References
----------

* https://github.com/solidusio/solidus_frontend/security/advisories/GHSA-87gm-56c6-255g
* https://github.com/solidusio/solidus/security/advisories/GHSA-x943-j5hw-mr2w (companion advisory for solidus_core)

If you have any questions about how to secure your site please stop by our
Slack: http://slack.solidus.io/