I got a PCI compliance report that raised an issue with Reflected Cross-Site Scripting on category pages.

On testing it would appear that the 'Items Per Page' drop down can be made to print some Javascript if added as a GET reqest (ie http://example.com/category.html?"<script>alert('test')</script>")

I'm using Magento The template file I'm using (page/html/pager.phtml) is largely unchanged and when I rename it so that it falls back on the base template I get the same issue.

The issue is caused by the $this->getLimitUrl($_key) call in the select option.

From Mage_Page_Block_Html_Pager:

public function getLimitUrl($limit)
    return $this->getPagerUrl(array($this->getLimitVarName()=>$limit));

public function getPagerUrl($params=array())
    $urlParams = array();
    $urlParams['_current']  = true;
    $urlParams['_escape']   = true;
    $urlParams['_use_rewrite']   = true;
    $urlParams['_query']    = $params;
    return $this->getUrl('*/*/*', $urlParams);

Any ideas?

  • do you get this issue with the base template? Aug 19, 2014 at 12:05

1 Answer 1


In the end I manually manipulated all the links in the template/catalog/product/list/toolbar.phtml and template/page/html/pager.phtml files so they looked something like this:

<?php $url = explode('?', $this->getPageUrl($_page)); ?>
<li><a href="<?php echo $url[0] ?>"><?php echo $_page ?></a></li>

There's certainly nothing pretty about it but it did the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.