Resolve template injection with context name

[asmecher]

Describe the bug
The context name (e.g. journal name in OJS or site name) is susceptible to Vue template injection (e.g. {{ 4*5 }} will present as 20 rather than as a literal string.

After some review, the impact of this issue is fortunately low -- the affected fields are for privileged users, who already (intentionally) have tools to e.g. enter arbitrary Javascript in certain fields. Injectability requires:

• The content must be inserted into back-end template markup (e.g. using Smarty)
• The content must not be added to the DOM dynamically, i.e. it must be present in the initial page generation.

We were not able to identify other cases meeting these requirements.

What application are you using?
OJS, OMP or OPS version 3.4.0

Reported by Daniel Barros.

[asmecher]

PRs:

• stable-3_3_0: pkp/pkp-lib#9650 Fix template injection in context name (stable-3_3_0) #9653
• stable-3_4_0: pkp/pkp-lib#9650 Fix template injection in context name (stable-3_4_0) #9654
• main: pkp/pkp-lib#9650 Fix template injection in context name (main) #9655

[asmecher]

@jardakotesovec, could you review the PRs? I've tested them here. Thanks!

[jardakotesovec]

3.3
ojs (only tests): pkp/ojs#4181
pkp-lib: #9712
3.4
ojs (only tests): pkp/ojs#4180
pkp-lib: #9711

[jardakotesovec]

@asmecher Tests are passing - for 3.3.0 most of the runs are passing, which I think we consider as pass :-). So feel free to merge these.

[asmecher]

Sorry for the headache, @jardakotesovec, but could you reformat the stable-3_3_0 changes with tabs instead of spaces? (At some point this will go away!)

[jardakotesovec]

@asmecher should be better now..

[asmecher]

Thanks! There was an accidental submodule update, but I removed it. I'll file a new issue for main so we don't forget to deal with 3.5.0 and forward.

[jardakotesovec]

Ops, not sure how that happened. Sorry about that.