xss triggered in "myshopify.com/admin/product"

Summary

@jaka_tingkir discovered a bypass to an HTML sanitization function on the Collections and Products Rich Text Editor. Until recently, all reports regarding cross site scripting in the Rich Text Editor were considered a Known Issue under our program:

• XSS - Rich Text Editor - Any issue related to execution of javascript in the Rich Text Editor (for example, when editing the description of a product, blog or collection, etc).

Recently we deployed an HTML sanitization function to the Rich Text Editor in specific sections of the administrative area. We then updated the exclusion to mention specific pages that are still vulnerable:

• XSS - Rich Text Editor - Issues relating to execution of JavaScript in the legacy Rich Text Editor in the Legal settings, Blogs section, and Pages section of the Shopify admin.

As this exclusion states, all new reports regarding the legal settings, blogs, and pages sections will still be considered invalid and a Known Issue. New XSS reports regarding the rich text editors in the Products and Collections sections may be valid.