XSS vulnerabilities

[yunai39]

Hello,

In commit ad946eb34293c72d0743f6c4febd2155a957b64e

I was changed from this

$queryString = $this->request->getQueryString();

To this

if (null === $queryString = $this->request->server->get('QUERY_STRING')){
    $queryString = $this->request->getQueryString();
}

$this->request->server->get('QUERY_STRING')), return an str which is not normalized and this create an XSS vulnerability.

If you call https://demo.thelia.net/?"><script>alert(81)</script>= (in a browser that does not encode url or using postman), you can will get <script>alert(81)</script> render in the dom and interpreted.