XSS in Drupal 7 Views Replacement token

Question

I am working on a Drupal 7 site that uses a replacement pattern %1 inside a View header to generate a URL with the Organic Group id(og_group_ref).

The view header markup is

<a class="ct" href="/node/add/post?og_group_ref=%1">Create Convo</a>

Example URL of a page is site/b_posts/2, so the link created would be /node/add/post?og_group_ref=2.

This is vulnerable to XSS, since accessing the URL site/b_posts/%22%20onmouseover=%22alert%28559%29%22%20test=%22/2 would result in a JS alert getting executed on mousing over the link. How to protect against this? I used the latest version of Views and this is still happening.

Answer 1

You must enable validation on your contextual filter.

More information found here:

https://drupal.org/node/1578564

http://nodeone.se/en/learn-views-with-nodeone-part-23-validation-of-contextual-filter-input