From 68a5b9c25a58a6dbc4369aaacae27ffa2bdc8cf2 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 15 Apr 2026 07:44:33 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0689=20SNS=20=EA=B3=B5?=
 =?UTF-8?q?=EC=9C=A0=20=EC=8A=A4=ED=82=A8=20Reflected=20XSS=20=EC=88=98?=
 =?UTF-8?q?=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

$_SERVER['REQUEST_URI']를 JavaScript 문자열에 이스케이프 없이
출력하여 URL을 통한 Reflected XSS가 가능한 취약점을
json_encode()로 안전하게 이스케이프 처리

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 plugin/sns/view.sns.skin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugin/sns/view.sns.skin.php b/plugin/sns/view.sns.skin.php
index 7ef224d07..39a793c34 100644
--- a/plugin/sns/view.sns.skin.php
+++ b/plugin/sns/view.sns.skin.php
@@ -38,7 +38,7 @@ $bo_v_sns_class = $config['cf_kakao_js_apikey'] ? 'show_kakao' : '';
                 }
             }
 
-            var webUrl = location.protocol+"<?php echo '//'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; ?>",
+            var webUrl = location.protocol+<?php echo json_encode('//'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); ?>,
                 imageUrl = $("#bo_v_img").find("img").attr("src") || $(".view_image").find("img").attr("src") || '';
 
             Kakao.Link.sendDefault({