auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

• clone example project https://github.com/DamienHarper/auditor-bundle-demo
• create author with FullName <script>alert()</script>
• delete author
• view audit of authors
• alert is displayed

Impact

persistent XSS. JS can be injected and executed.