HTML Injection in filename

[claunch3r]

This issue is unique.

• I have used the search tool and did not find an issue describing my bug.

Operating System

Linux (DEB package)

Version information

8.0.1.31

Expected Behavior

I was expecting to see that the file name would not be formatted.

Actual Behavior

The file name is formatted using HTML tags.

Reproduction Steps

1. Create a file that contains an HTML tag in its name;
2. Open this file using OnlyOffice;
3. As a result, the file name will be formatted, leading to an HTML Injection vulnerability.

POC:
filename: <h1>test.xlsx

filename: <s>test.xlsx

filename: <ul><li>test.xlsx

Additional information

No response

[ElenaMaaya]

Hello @claunch3r !
Thank you for report!
I can confirm that the problem exists. I created ticket 71725 in our issue tracker with your issue.