Skip to content

fix: escaping HasWidth@getWidth return value#19980

Merged
danharrin merged 4 commits into
filamentphp:4.xfrom
Carnicero90:fix/has-width-escape-getwidth
Jun 6, 2026
Merged

fix: escaping HasWidth@getWidth return value#19980
danharrin merged 4 commits into
filamentphp:4.xfrom
Carnicero90:fix/has-width-escape-getwidth

Conversation

@Carnicero90

Copy link
Copy Markdown
Contributor

Description

HasWidth::getWidth() returns an unescaped string that is placed directly
into a style attribute via @style in two Blade templates:

  • packages/tables/resources/views/index.blade.php
  • packages/forms/resources/views/components/repeater/table.blade.php

I initially noticed this while working on something else and didn't think it
was worth reporting. After seeing #19885 (same pattern, ImageColumn/ImageEntry
src attribute), it felt consistent enough to fix here too (although, in that case, I think it's less security sensitive).

e() prevents breaking out of the style attribute (e.g. 200px" onclick="..."),
but CSS property injection remains possible (e.g. 200px; background: red).
Happy to add strtok($width, ';') before e() if that's considered in scope,
but wanted to check first.

Visual changes

None, as long as somebody wasnt using ->width for a self-xss-attack.

Functional changes

  • Code style has been fixed by running the composer cs command.
  • Changes have been tested to not break existing functionality. (Although, technically, is a breaking change for whoever was using it to inject stuff).
  • Documentation is up-to-date.

@github-project-automation github-project-automation Bot moved this to Todo in Roadmap May 27, 2026
@danharrin danharrin added bug Something isn't working pending review labels May 29, 2026
@danharrin danharrin added this to the v4 milestone May 29, 2026
@danharrin danharrin merged commit 1d75070 into filamentphp:4.x Jun 6, 2026
@github-project-automation github-project-automation Bot moved this from Todo to Done in Roadmap Jun 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants