CVE-2023-1892: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2023-04-21T05:15Z
Repository: https://github.com/sidekiq/sidekiq
Language: Ruby
Files changed: Changes.md, lib/sidekiq/version.rb, lib/sidekiq/web/application.rb
Commit date: 2023-04-05 10:12:47 -0700
Commit message: Trim :period parameter to two characters and escape the value

Diff: diff --git a/Changes.md b/Changes.md
index ccfa7930..1311c4ad 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,13 +1,16 @@
 # Sidekiq Changes
 
 [Sidekiq Changes](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) | [Sidekiq Pro Changes](https://github.com/sidekiq/sidekiq/blob/main/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/sidekiq/sidekiq/blob/main/Ent-Changes.md)
 
-HEAD
+7.0.8
 ----------
 
-- Add job hash as another parameter to any `sidekiq_retry_in` block.
+- **SECURITY** Sanitize `period` input parameter on Metrics pages.
+  Specially crafted values can lead to XSS. This functionality
+  was introduced in 7.0.4. Thank you to spercex @ huntr.dev [#5694]
+- Add job hash as 3rd parameter to the `sidekiq_retry_in` block.
 
 7.0.7
 ----------
 
 - Fix redis-client API usage which could result in stuck Redis
diff --git a/lib/sidekiq/version.rb b/lib/sidekiq/version.rb
index bc3a8093..45b62a4e 100644
--- a/lib/sidekiq/version.rb
+++ b/lib/sidekiq/version.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Sidekiq
-  VERSION = "7.0.7"
+  VERSION = "7.0.8"
   MAJOR = 7
 end
diff --git a/lib/sidekiq/web/application.rb b/lib/sidekiq/web/application.rb
index 33cfb87c..ca655bb2 100644
--- a/lib/sidekiq/web/application.rb
+++ b/lib/sidekiq/web/application.rb
@@ -66,20 +66,20 @@ module Sidekiq
       erb(:dashboard)
     end
 
     get "/metrics" do
       q = Sidekiq::Metrics::Query.new
-      @period = params[:period]
+      @period = h((params[:period] || "")[0..1])
       @periods = METRICS_PERIODS
       minutes = @periods.fetch(@period, @periods.values.first)
       @query_result = q.top_jobs(minutes: minutes)
       erb(:metrics)
     end
 
     get "/metrics/:name" do
       @name = route_params[:name]
-      @period = params[:period]
+      @period = h((params[:period] || "")[0..1])
       q = Sidekiq::Metrics::Query.new
       @periods = METRICS_PERIODS
       minutes = @periods.fetch(@period, @periods.values.first)
       @query_result = q.for_job(@name, minutes: minutes)
       erb(:metrics_for_job)

Vulnerable code: HEAD
- Add job hash as another parameter to any `sidekiq_retry_in` block.
  VERSION = "7.0.7"
      @period = params[:period]
      @period = params[:period]
Fixed code: 7.0.8
- **SECURITY** Sanitize `period` input parameter on Metrics pages.
  Specially crafted values can lead to XSS. This functionality
  was introduced in 7.0.4. Thank you to spercex @ huntr.dev [#5694]
- Add job hash as 3rd parameter to the `sidekiq_retry_in` block.
  VERSION = "7.0.8"
      @period = h((params[:period] || "")[0..1])
      @period = h((params[:period] || "")[0..1])