FOUR-32745: Prevent stored XSS in user directory

[eiresendez]

Issue & Reproduction Steps

A low-privilege user can bypass the single-pass profile sanitizer with nested HTML, store executable markup in user profile fields, and trigger it when an authorized user opens /admin/users.

1. Update firstname, lastname, or title through PUT /api/1.0/users/{id} using a nested HTML payload.
2. Retrieve the stored user and observe that the payload has become executable markup.
3. Open /admin/users as a user with directory access.
4. Observe that the stored payload executes in the viewer's session.

Solution

• Validate firstname, lastname, and title as plain text before persistence.
• Require edit-personal-profile and enforce a profile-field allowlist for non-administrative self-service updates.
• Keep username and password changes protected by edit-user-and-password.
• Send only profile-editable fields from the profile page.
• Render fullname through escaped Vue slots in active and deleted user listings.
• Add regression coverage for markup validation, authorization, atomic rejection, credential permissions, and administrative updates.

How to Test

• Run ./vendor/bin/phpunit tests/unit/ProcessMaker/Rules/PlainTextTest.php tests/Feature/Api/UsersTest.php tests/Feature/ProfileTest.php.
• Run npm run development.
• Confirm markup payloads return 422, unauthorized or disallowed self-service updates return 403, and valid updates return 204.
• Open both Users and Deleted Users and confirm existing malicious names appear as literal text without creating executable DOM nodes or JavaScript dialogs.

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-32745

ci:deploy

[nolanpro]

QA server K8S was successfully deployed https://ci-2f0532ef18.engk8s.processmaker.net

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[nolanpro]

QA server K8S was successfully deployed https://ci-2f0532ef18.engk8s.processmaker.net

[eiresendez]

Hi @gustavobascope could you please do a code review when you have a chance? Thanks!!

[CarliPinell]

The code looks good. No observations.

[CarliPinell]

No observations were found.

[gustavobascope]

Approved