Merge branch 'release/6.2.2'

Author: rhukster

CHANGELOG.md

@@ -1,3 +1,9 @@
+# v6.2.2
+## 07/02/2026
+
+1. [](#bugfix)
+    * [security] Shortcode parameters that set an element's color, size, id, class or style are now escaped when written into the page, closing a stored cross-site scripting hole where a crafted value could break out of the attribute and run script in a visitor's or an administrator's browser ([GHSA-q5fw-vpqc-fgph](https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph)).
+
 # v6.2.1
 ## 06/29/2026
 

blueprints.yaml

@@ -1,7 +1,7 @@
 name: Shortcode Core
 slug: shortcode-core
 type: plugin
-version: 6.2.1
+version: 6.2.2
 description: "This plugin provides the core functionality for shortcode plugins"
 icon: code
 author:

classes/shortcodes/ColorShortcode.php

@@ -8,7 +8,7 @@ class ColorShortcode extends Shortcode
     public function init()
     {
         $this->shortcode->getHandlers()->add('color', function(ShortcodeInterface $sc) {
-            $color = $sc->getParameter('color', $this->getBbCode($sc));
+            $color = self::escAttr($sc->getParameter('color', $this->getBbCode($sc)));
 
             return '<span style="color: ' . $color . ';">' . $sc->getContent() . '</span>';
         });

classes/shortcodes/ColumnsShortcode.php

@@ -9,9 +9,10 @@ public function init()
     {
         $this->shortcode->getHandlers()->add('columns', static function(ShortcodeInterface $sc) {
             $column_count = (int)$sc->getParameter('count', 2);
-            $column_width = $sc->getParameter('width', 'auto');
-            $column_gap = $sc->getParameter('gap', 'normal');
+            $column_width = self::escAttr($sc->getParameter('width', 'auto'));
+            $column_gap = self::escAttr($sc->getParameter('gap', 'normal'));
             $column_rule = $sc->getParameter('rule', false);
+            $column_rule = $column_rule ? self::escAttr($column_rule) : $column_rule;
 
             $css_style = 'columns:' . $column_count . ' ' . $column_width . ';-moz-columns:' . $column_count . ' ' . $column_width . ';';
             $css_style .= 'column-gap:' . $column_gap . ';-moz-column-gap:' . $column_gap . ';';

classes/shortcodes/DetailsShortcode.php

@@ -14,7 +14,7 @@ public function init()
 
             // Get classes for details
             $class = $sc->getParameter('class', $this->getBbCode($sc));
-            $classHTML = (isset($class) and $class !== $summary) ? 'class="' . $class . '"' : '';
+            $classHTML = (isset($class) and $class !== $summary) ? 'class="' . self::escAttr($class) . '"' : '';
 
             // Get content
             $content = $sc->getContent();

classes/shortcodes/DivShortcode.php

@@ -8,9 +8,9 @@ class DivShortcode extends Shortcode
     public function init()
     {
         $this->shortcode->getHandlers()->add('div', static function(ShortcodeInterface $sc) {
-            $id = $sc->getParameter('id');
-            $class = $sc->getParameter('class');
-            $style = $sc->getParameter('style');
+            $id = self::escAttr($sc->getParameter('id'));
+            $class = self::escAttr($sc->getParameter('class'));
+            $style = self::escAttr($sc->getParameter('style'));
 
             $id_output = $id ? ' id="' . $id . '" ': '';
             $class_output = $class ? ' class="' . $class . '"' : '';

classes/shortcodes/FigureShortcode.php

@@ -9,8 +9,8 @@ class FigureShortcode extends Shortcode
     public function init()
     {
         $this->shortcode->getHandlers()->add('figure', function(ShortcodeInterface $sc) {
-            $id = $sc->getParameter('id');
-            $class = $sc->getParameter('class');
+            $id = self::escAttr($sc->getParameter('id'));
+            $class = self::escAttr($sc->getParameter('class'));
             $caption = $sc->getParameter('caption');
             $page = $this->grav['page'];
 

classes/shortcodes/FontAwesomeShortcode.php

@@ -44,7 +44,7 @@ public function init()
                     }
                 }
 
-                return '<i class="' . $fa_class . ' ' . $icon . '">' . $str . '</i>';
+                return '<i class="' . self::escAttr($fa_class . ' ' . $icon) . '">' . $str . '</i>';
             }
 
             return '';

classes/shortcodes/HShortcode.php

@@ -36,8 +36,8 @@ public function init()
 
     protected function header($level, ShortcodeInterface $sc)
     {
-        $id = $sc->getParameter('id');
-        $class = $sc->getParameter('class');
+        $id = self::escAttr($sc->getParameter('id'));
+        $class = self::escAttr($sc->getParameter('class'));
         $tag = 'h' . $level;
 
         $id_output = $id ? ' id="' . $id . '" ': '';

classes/shortcodes/MarkShortcode.php

@@ -9,7 +9,7 @@ public function init()
     {
         $this->shortcode->getHandlers()->add('mark', function(ShortcodeInterface $sc) {
             $style = $sc->getParameter('style', $this->getBbCode($sc));
-            $class = $sc->getParameter('class', 'default');
+            $class = self::escAttr($sc->getParameter('class', 'default'));
 
             $css_class = 'class="mark-class-' . $class . '"';