CVE-2022-4731: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-25T11:15Z
Repository: https://github.com/myapnea/myapnea.org
Language: Other
Files changed: CHANGELOG.md, app/views/layouts/application.html.haml, app/views/layouts/full_page.html.haml, app/views/layouts/full_page_custom_header.html.haml, app/views/layouts/full_page_no_header.haml, app/views/layouts/full_page_sidebar.html.haml
Commit date: 2022-04-23 13:44:11 -0400
Commit message: Fixed a Cross Site Scripting (XSS) issue

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d38f650..721df994 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,10 @@
 ## 29.1.0
 
 ### Enhancements
+- **Security Changes**
+  - Fixed a Cross Site Scripting (XSS) issue
 - **Gem Changes**
   - Update to Ruby 3.1.2
 
 ## 29.0.0 (April 19, 2022)
 
diff --git a/app/views/layouts/application.html.haml b/app/views/layouts/application.html.haml
index 4fd6f0bb..f58705f2 100644
--- a/app/views/layouts/application.html.haml
+++ b/app/views/layouts/application.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
+    %title= [@title, "MyApnea"].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page.html.haml b/app/views/layouts/full_page.html.haml
index 5b508bda..251508e2 100644
--- a/app/views/layouts/full_page.html.haml
+++ b/app/views/layouts/full_page.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
+    %title= [@title, "MyApnea"].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_custom_header.html.haml b/app/views/layouts/full_page_custom_header.html.haml
index 9c1eff3c..83aaada6 100644
--- a/app/views/layouts/full_page_custom_header.html.haml
+++ b/app/views/layouts/full_page_custom_header.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
+    %title= [@title, "MyApnea"].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_no_header.haml b/app/views/layouts/full_page_no_header.haml
index cdfcaf92..60be9869 100644
--- a/app/views/layouts/full_page_no_header.haml
+++ b/app/views/layouts/full_page_no_header.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
+    %title= [@title, "MyApnea"].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_sidebar.html.haml b/app/views/layouts/full_page_sidebar.html.haml
index 2e279c14..2b8b7814 100644
--- a/app/views/layouts/full_page_sidebar.html.haml
+++ b/app/views/layouts/full_page_sidebar.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
+    %title= [@title, "MyApnea"].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }

Vulnerable code:     %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
Fixed code: - **Security Changes**
  - Fixed a Cross Site Scripting (XSS) issue
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")