CVE-2022-0838: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-04T08:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: JavaScript
Files changed: web/js/app.js, web/js/pages/add_db.js, web/js/pages/add_dns_rec.js, web/js/pages/add_mail_acc.js, web/js/pages/add_web.js, web/js/pages/edit_db.js, web/js/pages/edit_dns_rec.js, web/js/pages/edit_mail_acc.js, web/templates/pages/add_db.html, web/templates/pages/edit_db.html
Commit date: 2022-03-03 15:22:35 +0100
Commit message: replace html() with text

+ 2 small problems on add / edit database page

Diff: diff --git a/web/js/app.js b/web/js/app.js
index ea14621581..7bd5bc70f4 100644
--- a/web/js/app.js
+++ b/web/js/app.js
@@ -61,11 +61,10 @@ $.fn.scrollTo = function( target, options, callback ){
  * Returns a formatted version of the given date.
  * The date defaults to the current date/time.
  * The mask defaults to dateFormat.masks.default.
  */
 
-
 var dateFormat = function () {
     var token = /d{1,4}|m{1,4}|yy(?:yy)?|([HhMsTt])\1?|[LloSZ]|"[^"]*"|'[^']*'/g,
         timezone = /\b(?:[PMCEA][SDP]T|(?:Pacific|Mountain|Central|Eastern|Atlantic) (?:Standard|Daylight|Prevailing) Time|(?:GMT|UTC)(?:[-+]\d{4})?)\b/g,
         timezoneClip = /[^-+\dA-Z]/g,
         pad = function (val, len) {
diff --git a/web/js/pages/add_db.js b/web/js/pages/add_db.js
index 82b757e6a6..0660c0473c 100644
--- a/web/js/pages/add_db.js
+++ b/web/js/pages/add_db.js
@@ -1,21 +1,21 @@
 //
 //
 // Updates database username dynamically, showing its prefix
 App.Actions.DB.update_db_username_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     } 
     $(elm).parent().find('.hint').text(GLOBAL.DB_USER_PREFIX + hint);
 }
 
 //
 //
 // Updates database name dynamically, showing its prefix
 App.Actions.DB.update_db_databasename_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     } 
     $(elm).parent().find('.hint').text(GLOBAL.DB_DBNAME_PREFIX + hint);
 }
 
 //
diff --git a/web/js/pages/add_dns_rec.js b/web/js/pages/add_dns_rec.js
index 06c3649e5f..a6ebb04623 100644
--- a/web/js/pages/add_dns_rec.js
+++ b/web/js/pages/add_dns_rec.js
@@ -2,11 +2,11 @@
 //
 // Updates database dns record dynamically, showing its full domain path
 App.Actions.DB.update_dns_record_hint = function(elm, hint) {
     // clean hint
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     }
 
     // set domain name without rec in case of @ entries
     if (hint == '@') {
         hint = '';
diff --git a/web/js/pages/add_mail_acc.js b/web/js/pages/add_mail_acc.js
index 153f099eb9..28fe256c2b 100644
--- a/web/js/pages/add_mail_acc.js
+++ b/web/js/pages/add_mail_acc.js
@@ -139,11 +139,11 @@ randomString = function(min_length = 16) {
 
 generate_mail_credentials = function() {
     var div = $('.mail-infoblock').clone();
     div.find('#mail_configuration').remove();
     var pass=div.find('#v_password').text();
-    if (pass=="") div.find('#v_password').html(' ');
+    if (pass=="") div.find('#v_password').text(' ');
     var output = div.text();
     output=output.replace(/(?:\r\n|\r|\n|\t)/g, "|");
     output=output.replace(/  /g, "");
     output=output.replace(/\|\|/g, "|");
     output=output.replace(/\|\|/g, "|");
@@ -186,33 +186,33 @@ $(document).ready(function() {
     $('#mail_configuration').change(function(evt){
         var opt = $(evt.target).find('option:selected');
 
         switch(opt.attr('v_type')){
             case 'hostname':
-                $('#td_imap_hostname').html(opt.attr('domain'));
-                $('#td_smtp_hostname').html(opt.attr('domain'));
+                $('#td_imap_hostname').text(opt.attr('domain'));
+                $('#td_smtp_hostname').text(opt.attr('domain'));
                 break;
             case 'starttls':
-                $('#td_imap_port').html('143');
-                $('#td_imap_encryption').html('STARTTLS');
-                $('#td_smtp_port').html('587');
-                $('#td_smtp_encryption').html('STARTTLS');
+                $('#td_imap_port').text('143');
+                $('#td_imap_encryption').text('STARTTLS');
+                $('#td_smtp_port').text('587');
+                $('#td_smtp_encryption').text('STARTTLS');
                 break;
             case 'ssl':
-                $('#td_imap_port').html('993');
-                $('#td_imap_encryption').html('SSL / TLS');
-                $('#td_smtp_port').html('465');
-                $('#td_smtp_encryption').html('SSL / TLS');
+                $('#td_imap_port').text('993');
+                $('#td_imap_encryption').text('SSL / TLS');
+                $('#td_smtp_port').text('465');
+                $('#td_smtp_encryption').text('SSL / TLS');
                 break;
             case 'no_encryption':
-                $('#td_imap_hostname').html(opt.attr('domain'));
-                $('#td_smtp_hostname').html(opt.attr('domain'));
+                $('#td_imap_hostname').text(opt.attr('domain'));
+                $('#td_smtp_hostname').text(opt.attr('domain'));
 
-                $('#td_imap_port').html('143');
-                $('#td_imap_encryption').html(opt.attr('no_encryption'));
-                $('#td_smtp_port').html('25');
-                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
+                $('#td_imap_port').text('143');
+                $('#td_imap_encryption').text(opt.attr('no_encryption'));
+                $('#td_smtp_port').text('25');
+                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
                 break;
         }
         generate_mail_credentials();
     });
 });
diff --git a/web/js/pages/add_web.js b/web/js/pages/add_web.js
index 87daf45648..5118d1c338 100644
--- a/web/js/pages/add_web.js
+++ b/web/js/pages/add_web.js
@@ -1,11 +1,11 @@
  App.Actions.WEB.update_custom_doc_root = function(elm, hint) {
     var prepath = $('input[name="v-custom-doc-root_prepath"]').val();
     var domain = $('select[name="v-custom-doc-domain"]').val();
     var folder = $('input[name="v-custom-doc-folder"]').val();
     console.log(domain, folder);
-    $('.custom_docroot_hint').html(prepath+domain+'/public_html/'+folder);
+    $('.custom_docroot_hint').text(prepath+domain+'/public_html/'+folder);
 }
 App.Listeners.DB.keypress_custom_folder = function() {
     var ref = $('input[name="v-custom-doc-folder"]');
     var current_rec = ref.val();
     App.Actions.WEB.update_custom_doc_root(ref, current_rec);
@@ -38,11 +38,11 @@ App.Listeners.DB.change_custom_doc = function() {
 App.Listeners.DB.keypress_custom_folder();
 App.Listeners.DB.change_custom_doc();
 
 App.Actions.WEB.update_ftp_username_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     }
     
     hint = hint.replace(/[^\w\d]/gi, '');
 
     $(elm).parent().find('.v-ftp-user').val(hint);
@@ -86,11 +86,11 @@ App.Listeners.WEB.keypress_domain_name = function() {
 //
 //
 
 App.Actions.WEB.update_ftp_path_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.v-ftp-path-hint').html('');
+        $(elm).parent().find('.v-ftp-path-hint').text('');
     }
 
     if (hint[0] != '/') {
         hint = '/' + hint;
     }
diff --git a/web/js/pages/edit_db.js b/web/js/pages/edit_db.js
index 9a8a514ee1..a82ed4e8c3 100644
--- a/web/js/pages/edit_db.js
+++ b/web/js/pages/edit_db.js
@@ -1,21 +1,21 @@
 //
 //
 // Updates database username dynamically, showing its prefix
 App.Actions.DB.update_db_username_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     } 
     $(elm).parent().find('.hint').text(GLOBAL.DB_USER_PREFIX + hint);
 }
 
 //
 //
 // Updates database name dynamically, showing its prefix
 App.Actions.DB.update_db_databasename_hint = function(elm, hint) {
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     } 
     $(elm).parent().find('.hint').text(GLOBAL.DB_DBNAME_PREFIX + hint);
 }
 
 //
diff --git a/web/js/pages/edit_dns_rec.js b/web/js/pages/edit_dns_rec.js
index 06c3649e5f..a6ebb04623 100644
--- a/web/js/pages/edit_dns_rec.js
+++ b/web/js/pages/edit_dns_rec.js
@@ -2,11 +2,11 @@
 //
 // Updates database dns record dynamically, showing its full domain path
 App.Actions.DB.update_dns_record_hint = function(elm, hint) {
     // clean hint
     if (hint.trim() == '') {
-        $(elm).parent().find('.hint').html('');
+        $(elm).parent().find('.hint').text('');
     }
 
     // set domain name without rec in case of @ entries
     if (hint == '@') {
         hint = '';
diff --git a/web/js/pages/edit_mail_acc.js b/web/js/pages/edit_mail_acc.js
index 3ff42ce74c..06b37764f8 100644
--- a/web/js/pages/edit_mail_acc.js
+++ b/web/js/pages/edit_mail_acc.js
@@ -117,11 +117,11 @@ randomString = function(min_length = 16) {
 }
 generate_mail_credentials = function() {
     var div = $('.mail-infoblock').clone();
     div.find('#mail_configuration').remove();
     var pass=div.find('#v_password').text();
-    if (pass=="") div.find('#v_password').html(' ');
+    if (pass=="") div.find('#v_password').text(' ');
     var output = div.text();
     output=output.replace(/(?:\r\n|\r|\n|\t)/g, "|");
     output=output.replace(/  /g, "");
     output=output.replace(/\|\|/g, "|");
     output=output.replace(/\|\|/g, "|");
@@ -164,33 +164,33 @@ $(document).ready(function() {
     $('#mail_configuration').change(function(evt){
         var opt = $(evt.target).find('option:selected');
 
         switch(opt.attr('v_type')){
             case 'hostname':
-                $('#td_imap_hostname').html(opt.attr('domain'));
-                $('#td_smtp_hostname').html(opt.attr('domain'));
+                $('#td_imap_hostname').text(opt.attr('domain'));
+                $('#td_smtp_hostname').text(opt.attr('domain'));
                 break;
             case 'starttls':
-                $('#td_imap_port').html('143');
-                $('#td_imap_encryption').html('STARTTLS');
-                $('#td_smtp_port').html('587');
-                $('#td_smtp_encryption').html('STARTTLS');
+                $('#td_imap_port').text('143');
+                $('#td_imap_encryption').text('STARTTLS');
+                $('#td_smtp_port').text('587');
+                $('#td_smtp_encryption').text('STARTTLS');
                 break;
             case 'ssl':
-                $('#td_imap_port').html('993');
-                $('#td_imap_encryption').html('SSL / TLS');
-                $('#td_smtp_port').html('465');
-                $('#td_smtp_encryption').html('SSL / TLS');
+                $('#td_imap_port').text('993');
+                $('#td_imap_encryption').text('SSL / TLS');
+                $('#td_smtp_port').text('465');
+                $('#td_smtp_encryption').text('SSL / TLS');
                 break;
             case 'no_encryption':
-                $('#td_imap_hostname').html(opt.attr('domain'));
-                $('#td_smtp_hostname').html(opt.attr('domain'));
+                $('#td_imap_hostname').text(opt.attr('domain'));
+                $('#td_smtp_hostname').text(opt.attr('domain'));
 
-                $('#td_imap_port').html('143');
-                $('#td_imap_encryption').html(opt.attr('no_encryption'));
-                $('#td_smtp_port').html('25');
-                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
+                $('#td_imap_port').text('143');
+                $('#td_imap_encryption').text(opt.attr('no_encryption'));
+                $('#td_smtp_port').text('25');
+                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
                 break;
         }
         generate_mail_credentials();
     });
 });
diff --git a/web/templates/pages/add_db.html b/web/templates/pages/add_db.html
index aa283c46b4..75831dfba9 100644
--- a/web/templates/pages/add_db.html
+++ b/web/templates/pages/add_db.html
@@ -59,11 +59,11 @@
 							</tr>
 						<?php } ?>
 						<?php if (($user == 'admin') && (($_GET['accept'] === "true")) || ($user !== "admin"))  {?>
 							<tr>
 								<td class="hint">
-									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user.'_</b>'); ?>
+									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user_plain.'_</b>'); ?>
 								</td>
 								</td>
 							</tr>
 							<tr>
 								<td class="vst-text step-top input-label">
@@ -225,8 +225,8 @@
 		</table>
 	</form>
 </div>
 
 <script>
-GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
-GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>";
+GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
+GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>_";
 </script>
\ No newline at end of file
diff --git a/web/templates/pages/edit_db.html b/web/templates/pages/edit_db.html
index 6cff3f6a70..f4f570892b 100644
--- a/web/templates/pages/edit_db.html
+++ b/web/templates/pages/edit_db.html
@@ -124,8 +124,8 @@
 		</table>
 	</form>
 </div>
 <?php if ($v_type == 'pgsql'){ $user=strtolower($user); } ?>
 <script>
-    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
-    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>";
+    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
+    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>_";
 </script>
\ No newline at end of file

Vulnerable code: 
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
    if (pass=="") div.find('#v_password').html(' ');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html('STARTTLS');
                $('#td_smtp_port').html('587');
                $('#td_smtp_encryption').html('STARTTLS');
                $('#td_imap_port').html('993');
                $('#td_imap_encryption').html('SSL / TLS');
                $('#td_smtp_port').html('465');
                $('#td_smtp_encryption').html('SSL / TLS');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html(opt.attr('no_encryption'));
                $('#td_smtp_port').html('25');
                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
    $('.custom_docroot_hint').html(prepath+domain+'/public_html/'+folder);
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.v-ftp-path-hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
    if (pass=="") div.find('#v_password').html(' ');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html('STARTTLS');
                $('#td_smtp_port').html('587');
                $('#td_smtp_encryption').html('STARTTLS');
                $('#td_imap_port').html('993');
                $('#td_imap_encryption').html('SSL / TLS');
                $('#td_smtp_port').html('465');
                $('#td_smtp_encryption').html('SSL / TLS');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html(opt.attr('no_encryption'));
                $('#td_smtp_port').html('25');
                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user.'_</b>'); ?>
GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>";
    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>";
Fixed code:         $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
    if (pass=="") div.find('#v_password').text(' ');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text('STARTTLS');
                $('#td_smtp_port').text('587');
                $('#td_smtp_encryption').text('STARTTLS');
                $('#td_imap_port').text('993');
                $('#td_imap_encryption').text('SSL / TLS');
                $('#td_smtp_port').text('465');
                $('#td_smtp_encryption').text('SSL / TLS');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text(opt.attr('no_encryption'));
                $('#td_smtp_port').text('25');
                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
    $('.custom_docroot_hint').text(prepath+domain+'/public_html/'+folder);
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.v-ftp-path-hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
    if (pass=="") div.find('#v_password').text(' ');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text('STARTTLS');
                $('#td_smtp_port').text('587');
                $('#td_smtp_encryption').text('STARTTLS');
                $('#td_imap_port').text('993');
                $('#td_imap_encryption').text('SSL / TLS');
                $('#td_smtp_port').text('465');
                $('#td_smtp_encryption').text('SSL / TLS');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text(opt.attr('no_encryption'));
                $('#td_smtp_port').text('25');
                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user_plain.'_</b>'); ?>
GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>_";
    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>_";