From e75165565e9e5956a73365c24d650ba40570ae72 Mon Sep 17 00:00:00 2001
From: Simon Wisselink <s.wisselink@iwink.nl>
Date: Fri, 24 Mar 2023 12:19:34 +0100
Subject: [PATCH 1/3] Implement fix and tests

---
 libs/plugins/modifier.escape.php              |  4 +++-
 libs/plugins/modifiercompiler.escape.php      |  4 +++-
 .../PluginModifierEscapeTest.php              | 21 +++++++++++++++++++
 .../Operators/templates_c/.gitignore          |  2 ++
 4 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore

diff --git a/libs/plugins/modifier.escape.php b/libs/plugins/modifier.escape.php
index 11e44682..e168679c 100644
--- a/libs/plugins/modifier.escape.php
+++ b/libs/plugins/modifier.escape.php
@@ -115,7 +115,9 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $
                     // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                     '<!--' => '<\!--',
                     '<s'   => '<\s',
-                    '<S'   => '<\S'
+                    '<S'   => '<\S',
+	                "`" => "\\\\`",
+	                "\${" => "\\\\\\$\\{"
                 )
             );
         case 'mail':
diff --git a/libs/plugins/modifiercompiler.escape.php b/libs/plugins/modifiercompiler.escape.php
index 602c3dbf..21b1b4c2 100644
--- a/libs/plugins/modifiercompiler.escape.php
+++ b/libs/plugins/modifiercompiler.escape.php
@@ -64,7 +64,9 @@ function smarty_modifiercompiler_escape($params, Smarty_Internal_TemplateCompile
                 // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
                 return 'strtr((string)' .
                        $params[ 0 ] .
-                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S" ))';
+                       ', array("\\\\" => "\\\\\\\\", "\'" => "\\\\\'", "\"" => "\\\\\"", "\\r" => "\\\\r", 
+                       "\\n" => "\\\n", "</" => "<\/", "<!--" => "<\!--", "<s" => "<\s", "<S" => "<\S",
+                       "`" => "\\\\`", "\${" => "\\\\\\$\\{"))';
         }
     } catch (SmartyException $e) {
         // pass through to regular plugin fallback
diff --git a/tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php b/tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php
index 309a71ab..073f9fcf 100644
--- a/tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php
+++ b/tests/UnitTests/TemplateSource/TagTests/PluginModifier/PluginModifierEscapeTest.php
@@ -237,4 +237,25 @@ class PluginModifierEscapeTest extends PHPUnit_Smarty
         $this->assertEquals("sma'rty@&#187;example&#171;.com", $this->smarty->fetch($tpl));
         Smarty::$_MBSTRING = true;
     }
+
+	public function testTemplateLiteralBackticks()
+	{
+		$tpl = $this->smarty->createTemplate('string:{"`Hello, World!`"|escape:"javascript"}');
+		$this->assertEquals("\\`Hello, World!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralInterpolation()
+	{
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->smarty->assign('vector', "`Hello, \${name}!`");
+		$this->assertEquals("\\`Hello, \\\$\\{name}!\\`", $this->smarty->fetch($tpl));
+	}
+
+	public function testTemplateLiteralBackticksAndInterpolation()
+	{
+		$this->smarty->assign('vector', '`${alert(`Hello, ${name}!`)}${`\n`}`');
+		$tpl = $this->smarty->createTemplate('string:{$vector|escape:"javascript"}');
+		$this->assertEquals("\\`\\\$\\{alert(\\`Hello, \\\$\\{name}!\\`)}\\\$\\{\\`\\\\n\\`}\\`", $this->smarty->fetch($tpl));
+	}
+
 }
diff --git a/tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore b/tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore
new file mode 100644
index 00000000..d88cc144
--- /dev/null
+++ b/tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore
@@ -0,0 +1,2 @@
+# Ignore anything in here, but keep this directory
+*

From 2038890f194a1908413c9bb8ca1b055c45a53a02 Mon Sep 17 00:00:00 2001
From: Simon Wisselink <s.wisselink@iwink.nl>
Date: Fri, 24 Mar 2023 12:19:40 +0100
Subject: [PATCH 2/3] Changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d300faff..9fbd37fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- Fixed Cross site scripting vulnerability in Javascript escaping
+
 ### Fixed
 - `$smarty->muteUndefinedOrNullWarnings()` now also mutes PHP7 notices for undefined array indexes [#736](https://github.com/smarty-php/smarty/issues/736)
 - `$smarty->muteUndefinedOrNullWarnings()` now treats undefined vars and array access of a null or false variables 

From 71d113550c262db8f61272e1326ec09959687e09 Mon Sep 17 00:00:00 2001
From: Simon Wisselink <s.wisselink@iwink.nl>
Date: Tue, 28 Mar 2023 21:43:36 +0200
Subject: [PATCH 3/3] Add changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9fbd37fc..30325bbf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Security
-- Fixed Cross site scripting vulnerability in Javascript escaping
+- Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447.
 
 ### Fixed
 - `$smarty->muteUndefinedOrNullWarnings()` now also mutes PHP7 notices for undefined array indexes [#736](https://github.com/smarty-php/smarty/issues/736)