JSON-LD script tag vulnerable to XSS via </script> in content #34

New Issue

2026-05-31T01:18:57Z

jmiller commented

2026-05-31 01:18:57 +00:00

Problem

JsonLdBuilder::toScriptTag() at line 163 concatenates JSON directly into a <script> tag:

return '<script type="application/ld+json">' . $json . '</script>';

If any OG data (title, description, author name) contains the string </script>, the browser will interpret it as closing the script block, allowing arbitrary HTML/JS injection.

Impact

Security vulnerability: An article author or anyone who can set OG title/description could inject JavaScript via stored XSS through the JSON-LD output.

Fix

Escape </ sequences in the JSON output before embedding in the script tag:

$json = str_replace('</', '<\\/', $json);

This is the standard mitigation per the HTML spec for inline JSON.

File

src/packages/plg_system_mokoog/src/Helper/JsonLdBuilder.php:163-166

## Problem `JsonLdBuilder::toScriptTag()` at line 163 concatenates JSON directly into a `<script>` tag: ```php return '<script type="application/ld+json">' . $json . '</script>'; ``` If any OG data (title, description, author name) contains the string `</script>`, the browser will interpret it as closing the script block, allowing arbitrary HTML/JS injection. ## Impact **Security vulnerability**: An article author or anyone who can set OG title/description could inject JavaScript via stored XSS through the JSON-LD output. ## Fix Escape `</` sequences in the JSON output before embedding in the script tag: ```php $json = str_replace('</', '<\\/', $json); ``` This is the standard mitigation per the HTML spec for inline JSON. ## File - `src/packages/plg_system_mokoog/src/Helper/JsonLdBuilder.php:163-166`

jmiller added the priority: high bug security labels 2026-05-31 01:18:57 +00:00

jmiller commented

2026-05-31 01:18:59 +00:00

Branch created: feature/34-json-ld-script-tag-vulnerable-to-xss-via

git fetch origin
git checkout feature/34-json-ld-script-tag-vulnerable-to-xss-via

Branch created: [`feature/34-json-ld-script-tag-vulnerable-to-xss-via`](https://git.mokoconsulting.tech/MokoConsulting/MokoJoomOpenGraph/src/branch/feature/34-json-ld-script-tag-vulnerable-to-xss-via) ```bash git fetch origin git checkout feature/34-json-ld-script-tag-vulnerable-to-xss-via ```

jmiller referenced this issue from a commit

2026-05-31 01:40:36 +00:00

fix(security): harden controllers, add site defaults, platform-specific OG tags

jmiller referenced this issue

2026-05-31 01:41:49 +00:00

Security hardening, site-wide OG defaults, platform-specific social tags #45

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomOpenGraph#34