item.icon is interpolated into markup on the Font Awesome paths

[bbrala]

Found while hardening selector handling for #731. Same defect family, different mechanism, and deliberately left out of that PR because icon is arguably trusted config rather than untrusted input.

Problem

src/jquery.contextMenu.js:1732 and :1742 build the icon element by string concatenation:

item._icon = $('<i class="' + item.icon + '"></i>');
// and
item._icon = $('<i class="fa ' + item.icon + '"></i>');

An item.icon value containing " or > breaks out of the attribute and injects arbitrary markup. This matters for any application that derives icon names from user-controlled or server-controlled data, for example a menu built from records where the icon is a stored field.

Suggested fix

Build the element and set the class without parsing, which is behaviourally identical for every legitimate value:

item._icon = $('<i></i>').addClass(item.icon);
// and
item._icon = $('<i></i>').addClass('fa').addClass(item.icon);

Related

• Potentail XSS vulnerability #731 hardened the selector-string paths (PR fix: never evaluate caller-supplied selector strings as HTML #804).
• Note the equivalent class interpolation only affects the fab /fas /fad /far /fal and legacy fa- branches. The built-in icon-font branch at :1744 builds a class name string rather than markup and is not affected.