CVE-2021-4265: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 924d16008cfcc09356c87db01848e45290cb58ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216467.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/siwapp/siwapp-ror
Language: Ruby
Files changed: app/models/common.rb, app/models/customer.rb, config/environments/production.rb, db/migrate/20160907152236_default_for_enabled.rb, db/migrate/20160908093323_add_indexes_on_deleted_column.rb, db/migrate/20160913081503_remove_status_from_commons.rb, db/migrate/20160915000824_add_active_to_customer.rb, db/migrate/20160915094942_add_failed_to_commons.rb, db/migrate/20160923100618_series_first_number.rb, db/migrate/20160929124104_email_and_print_template_to_common.rb, db/migrate/20160929133954_email_and_print_default_templates_to_template.rb, db/migrate/20161025134552_change_customer_index.rb, db/migrate/20161026092553_add_template_subject.rb, db/migrate/20161028103504_add_invoice_number_unique_number.rb, db/migrate/20161207184222_remove_tax_amount.rb, db/migrate/20161208171651_remove_commons_amounts.rb, db/migrate/20170112115658_remove_invoice_unique_number.rb, db/migrate/20170209101048_remove_customers_unique_name.rb, db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb, db/migrate/20170217120023_add_deleted_number_to_commons.rb, db/migrate/20170223101022_add_commons_customer_id_not_null.rb, db/migrate/20170608155530_add_currency_to_commons.rb
Commit date: 2021-10-19 11:07:49 +0200
Commit message: Fix possible XSS issues (#365)

* some fixes for old migrations, that allows new migrations

* force ssl default true unless env var

* check address no html tags
Diff: diff --git a/app/models/common.rb b/app/models/common.rb
index 0c70c1d..388d781 100644
--- a/app/models/common.rb
+++ b/app/models/common.rb
@@ -29,10 +29,14 @@ class Common < ActiveRecord::Base
   validates :series, presence: true
   # from https://emailregex.com/
   validates :email,
     format: {with: /\A([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,})\z/i,
              message: "Only valid emails"}, allow_blank: true
+  validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
+    message: "wrong format" }
+  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
+    message: "wrong format" }
 
   # Events
   after_save :purge_items
   after_save :update_amounts
   after_initialize :init
diff --git a/app/models/customer.rb b/app/models/customer.rb
index 2d6f8e5..78640a3 100644
--- a/app/models/customer.rb
+++ b/app/models/customer.rb
@@ -9,10 +9,14 @@ class Customer < ActiveRecord::Base
   has_many :recurring_invoices
 
   # Validation
   validate :valid_customer_identification
   validates_uniqueness_of :name,  scope: :identification
+  validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
+    message: "Wrong address format" }
+  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
+    message: "Wrong address format" }
 
   # Behaviors
   acts_as_taggable
 
   before_destroy :check_invoices
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 6bd81a6..ca506e7 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -45,11 +45,11 @@ Rails.application.configure do
   # config.action_cable.mount_path = nil
   # config.action_cable.url = 'wss://example.com/cable'
   # config.action_cable.allowed_request_origins = [ 'http://example.com', /http:\/\/example.*/ ]
 
   # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
-  # config.force_ssl = true
+  config.force_ssl = ENV['NO_FORCE_SSL'].present? ? false : true
 
   # Use the lowest log level to ensure availability of diagnostic information
   # when problems arise.
   config.log_level = :debug
 
diff --git a/db/migrate/20160907152236_default_for_enabled.rb b/db/migrate/20160907152236_default_for_enabled.rb
index 648734d..d60244d 100644
--- a/db/migrate/20160907152236_default_for_enabled.rb
+++ b/db/migrate/20160907152236_default_for_enabled.rb
@@ -1,6 +1,6 @@
-class DefaultForEnabled < ActiveRecord::Migration
+class DefaultForEnabled < ActiveRecord::Migration[4.2]
   def change
     change_column_default(:commons, :enabled, true)
     change_column_default(:commons, :draft, false)
   end
 end
diff --git a/db/migrate/20160908093323_add_indexes_on_deleted_column.rb b/db/migrate/20160908093323_add_indexes_on_deleted_column.rb
index 2a9c5c2..60667c1 100644
--- a/db/migrate/20160908093323_add_indexes_on_deleted_column.rb
+++ b/db/migrate/20160908093323_add_indexes_on_deleted_column.rb
@@ -1,6 +1,6 @@
-class AddIndexesOnDeletedColumn < ActiveRecord::Migration
+class AddIndexesOnDeletedColumn < ActiveRecord::Migration[4.2]
   def change
     add_index :commons, :deleted_at
     add_index :customers, :deleted_at
     add_index :items, :deleted_at
     add_index :payments, :deleted_at
diff --git a/db/migrate/20160913081503_remove_status_from_commons.rb b/db/migrate/20160913081503_remove_status_from_commons.rb
index 5a755b6..ecf1b42 100644
--- a/db/migrate/20160913081503_remove_status_from_commons.rb
+++ b/db/migrate/20160913081503_remove_status_from_commons.rb
@@ -1,5 +1,5 @@
-class RemoveStatusFromCommons < ActiveRecord::Migration
+class RemoveStatusFromCommons < ActiveRecord::Migration[4.2]
   def change
     remove_column :commons, :status
   end
 end
diff --git a/db/migrate/20160915000824_add_active_to_customer.rb b/db/migrate/20160915000824_add_active_to_customer.rb
index c5602cb..4999ec6 100644
--- a/db/migrate/20160915000824_add_active_to_customer.rb
+++ b/db/migrate/20160915000824_add_active_to_customer.rb
@@ -1,6 +1,6 @@
-class AddActiveToCustomer < ActiveRecord::Migration
+class AddActiveToCustomer < ActiveRecord::Migration[4.2]
   def up
     add_column :customers, :active, :boolean, default: true
     Customer.update_all ["active = ?", true]
   end
 
diff --git a/db/migrate/20160915094942_add_failed_to_commons.rb b/db/migrate/20160915094942_add_failed_to_commons.rb
index 458edc1..c6d1b36 100644
--- a/db/migrate/20160915094942_add_failed_to_commons.rb
+++ b/db/migrate/20160915094942_add_failed_to_commons.rb
@@ -1,5 +1,5 @@
-class AddFailedToCommons < ActiveRecord::Migration
+class AddFailedToCommons < ActiveRecord::Migration[4.2]
   def change
     add_column :commons, :failed, :boolean, default: false
   end
 end
diff --git a/db/migrate/20160923100618_series_first_number.rb b/db/migrate/20160923100618_series_first_number.rb
index 27c6493..5432762 100644
--- a/db/migrate/20160923100618_series_first_number.rb
+++ b/db/migrate/20160923100618_series_first_number.rb
@@ -1,6 +1,6 @@
-class SeriesFirstNumber < ActiveRecord::Migration
+class SeriesFirstNumber < ActiveRecord::Migration[4.2]
   def change
   	add_column :series, :first_number, :integer, default: 1
   	remove_column :series, :next_number
   end
 end
diff --git a/db/migrate/20160929124104_email_and_print_template_to_common.rb b/db/migrate/20160929124104_email_and_print_template_to_common.rb
index 91b7d30..f399d69 100644
--- a/db/migrate/20160929124104_email_and_print_template_to_common.rb
+++ b/db/migrate/20160929124104_email_and_print_template_to_common.rb
@@ -1,6 +1,6 @@
-class EmailAndPrintTemplateToCommon < ActiveRecord::Migration
+class EmailAndPrintTemplateToCommon < ActiveRecord::Migration[4.2]
   def change
   	rename_column :commons, :template_id, :print_template_id
   	add_column :commons, :email_template_id, :integer
   end
 end
diff --git a/db/migrate/20160929133954_email_and_print_default_templates_to_template.rb b/db/migrate/20160929133954_email_and_print_default_templates_to_template.rb
index c84dcc1..b2b7512 100644
--- a/db/migrate/20160929133954_email_and_print_default_templates_to_template.rb
+++ b/db/migrate/20160929133954_email_and_print_default_templates_to_template.rb
@@ -1,6 +1,6 @@
-class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration
+class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration[4.2]
   def change
   	rename_column :templates, :default, :print_default
   	add_column :templates, :email_default, :boolean, default: false
   end
 end
diff --git a/db/migrate/20161025134552_change_customer_index.rb b/db/migrate/20161025134552_change_customer_index.rb
index 8427ef8..8059c0e 100644
--- a/db/migrate/20161025134552_change_customer_index.rb
+++ b/db/migrate/20161025134552_change_customer_index.rb
@@ -1,6 +1,6 @@
-class ChangeCustomerIndex < ActiveRecord::Migration
+class ChangeCustomerIndex < ActiveRecord::Migration[4.2]
   def change
   	remove_index "customers", name: "cstm_idx"
   	add_index "customers", ["name", "identification"], name: "cstm_idx", unique: true, using: :btree
   end
 end
diff --git a/db/migrate/20161026092553_add_template_subject.rb b/db/migrate/20161026092553_add_template_subject.rb
index 08b35aa..3f97020 100644
--- a/db/migrate/20161026092553_add_template_subject.rb
+++ b/db/migrate/20161026092553_add_template_subject.rb
@@ -1,5 +1,5 @@
-class AddTemplateSubject < ActiveRecord::Migration
+class AddTemplateSubject < ActiveRecord::Migration[4.2]
   def change
   	add_column :templates, :subject, :string, limit: 200
   end
 end
diff --git a/db/migrate/20161028103504_add_invoice_number_unique_number.rb b/db/migrate/20161028103504_add_invoice_number_unique_number.rb
index 27f3b05..12f09d5 100644
--- a/db/migrate/20161028103504_add_invoice_number_unique_number.rb
+++ b/db/migrate/20161028103504_add_invoice_number_unique_number.rb
@@ -1,5 +1,5 @@
-class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration
+class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration[4.2]
   def change
   	add_index "commons", ["number", "series_id"], name: "common_unique_number_idx", unique: true, using: :btree
   end
 end
diff --git a/db/migrate/20161207184222_remove_tax_amount.rb b/db/migrate/20161207184222_remove_tax_amount.rb
index 27bc371..130d313 100644
--- a/db/migrate/20161207184222_remove_tax_amount.rb
+++ b/db/migrate/20161207184222_remove_tax_amount.rb
@@ -1,5 +1,5 @@
-class RemoveTaxAmount < ActiveRecord::Migration
+class RemoveTaxAmount < ActiveRecord::Migration[4.2]
   def change
     remove_column :commons, :tax_amount
   end
 end
diff --git a/db/migrate/20161208171651_remove_commons_amounts.rb b/db/migrate/20161208171651_remove_commons_amounts.rb
index 22f9500..dba0a63 100644
--- a/db/migrate/20161208171651_remove_commons_amounts.rb
+++ b/db/migrate/20161208171651_remove_commons_amounts.rb
@@ -1,6 +1,6 @@
-class RemoveCommonsAmounts < ActiveRecord::Migration
+class RemoveCommonsAmounts < ActiveRecord::Migration[4.2]
   def change
     remove_column :commons, :discount_amount
     remove_column :commons, :base_amount
   end
 end
diff --git a/db/migrate/20170112115658_remove_invoice_unique_number.rb b/db/migrate/20170112115658_remove_invoice_unique_number.rb
index 3ffa062..24c698d 100644
--- a/db/migrate/20170112115658_remove_invoice_unique_number.rb
+++ b/db/migrate/20170112115658_remove_invoice_unique_number.rb
@@ -1,5 +1,5 @@
-class RemoveInvoiceUniqueNumber < ActiveRecord::Migration
+class RemoveInvoiceUniqueNumber < ActiveRecord::Migration[4.2]
   def change
     remove_index "commons", name: "common_unique_number_idx"
   end
 end
diff --git a/db/migrate/20170209101048_remove_customers_unique_name.rb b/db/migrate/20170209101048_remove_customers_unique_name.rb
index 6f9adaf..b7c1512 100644
--- a/db/migrate/20170209101048_remove_customers_unique_name.rb
+++ b/db/migrate/20170209101048_remove_customers_unique_name.rb
@@ -1,5 +1,5 @@
-class RemoveCustomersUniqueName < ActiveRecord::Migration
+class RemoveCustomersUniqueName < ActiveRecord::Migration[4.2]
   def change
     remove_index "customers", name: "cstm_idx"
   end
 end
diff --git a/db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb b/db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb
index 9e64d24..2d48686 100644
--- a/db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb
+++ b/db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb
@@ -1,5 +1,5 @@
-class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration
+class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration[4.2]
   def change
     add_index "commons", ["series_id", "number"], name: "common_unique_number_idx", unique: true, using: :btree
   end
 end
diff --git a/db/migrate/20170217120023_add_deleted_number_to_commons.rb b/db/migrate/20170217120023_add_deleted_number_to_commons.rb
index 8c860aa..d4ce1ba 100644
--- a/db/migrate/20170217120023_add_deleted_number_to_commons.rb
+++ b/db/migrate/20170217120023_add_deleted_number_to_commons.rb
@@ -1,6 +1,6 @@
-class AddDeletedNumberToCommons < ActiveRecord::Migration
+class AddDeletedNumberToCommons < ActiveRecord::Migration[4.2]
   def change
     add_column :commons, :deleted_number, :integer, default: nil
     add_index "commons", ["series_id", "deleted_number"], name: "common_deleted_number_idx", using: :btree
   end
 end
diff --git a/db/migrate/20170223101022_add_commons_customer_id_not_null.rb b/db/migrate/20170223101022_add_commons_customer_id_not_null.rb
index 62e7b53..b7baeb9 100644
--- a/db/migrate/20170223101022_add_commons_customer_id_not_null.rb
+++ b/db/migrate/20170223101022_add_commons_customer_id_not_null.rb
@@ -1,5 +1,5 @@
-class AddCommonsCustomerIdNotNull < ActiveRecord::Migration
+class AddCommonsCustomerIdNotNull < ActiveRecord::Migration[4.2]
   def change
       change_column :commons, :customer_id, :integer, :null => false
   end
 end
diff --git a/db/migrate/20170608155530_add_currency_to_commons.rb b/db/migrate/20170608155530_add_currency_to_commons.rb
index cfdef37..62c1b5c 100644
--- a/db/migrate/20170608155530_add_currency_to_commons.rb
+++ b/db/migrate/20170608155530_add_currency_to_commons.rb
@@ -1,6 +1,6 @@
-class AddCurrencyToCommons < ActiveRecord::Migration
+class AddCurrencyToCommons < ActiveRecord::Migration[4.2]
   def up
     add_column :commons, :currency, :string, limit: 3
     currency = Settings.currency
     Common.find_each do |common|
       common.currency = currency

Vulnerable code:   # config.force_ssl = true
class DefaultForEnabled < ActiveRecord::Migration
class AddIndexesOnDeletedColumn < ActiveRecord::Migration
class RemoveStatusFromCommons < ActiveRecord::Migration
class AddActiveToCustomer < ActiveRecord::Migration
class AddFailedToCommons < ActiveRecord::Migration
class SeriesFirstNumber < ActiveRecord::Migration
class EmailAndPrintTemplateToCommon < ActiveRecord::Migration
class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration
class ChangeCustomerIndex < ActiveRecord::Migration
class AddTemplateSubject < ActiveRecord::Migration
class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration
class RemoveTaxAmount < ActiveRecord::Migration
class RemoveCommonsAmounts < ActiveRecord::Migration
class RemoveInvoiceUniqueNumber < ActiveRecord::Migration
class RemoveCustomersUniqueName < ActiveRecord::Migration
class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration
class AddDeletedNumberToCommons < ActiveRecord::Migration
class AddCommonsCustomerIdNotNull < ActiveRecord::Migration
class AddCurrencyToCommons < ActiveRecord::Migration
Fixed code:   validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "wrong format" }
  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "wrong format" }
  validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "Wrong address format" }
  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "Wrong address format" }
  config.force_ssl = ENV['NO_FORCE_SSL'].present? ? false : true
class DefaultForEnabled < ActiveRecord::Migration[4.2]
class AddIndexesOnDeletedColumn < ActiveRecord::Migration[4.2]
class RemoveStatusFromCommons < ActiveRecord::Migration[4.2]
class AddActiveToCustomer < ActiveRecord::Migration[4.2]
class AddFailedToCommons < ActiveRecord::Migration[4.2]
class SeriesFirstNumber < ActiveRecord::Migration[4.2]
class EmailAndPrintTemplateToCommon < ActiveRecord::Migration[4.2]
class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration[4.2]
class ChangeCustomerIndex < ActiveRecord::Migration[4.2]
class AddTemplateSubject < ActiveRecord::Migration[4.2]
class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration[4.2]
class RemoveTaxAmount < ActiveRecord::Migration[4.2]
class RemoveCommonsAmounts < ActiveRecord::Migration[4.2]
class RemoveInvoiceUniqueNumber < ActiveRecord::Migration[4.2]
class RemoveCustomersUniqueName < ActiveRecord::Migration[4.2]
class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration[4.2]
class AddDeletedNumberToCommons < ActiveRecord::Migration[4.2]
class AddCommonsCustomerIdNotNull < ActiveRecord::Migration[4.2]
class AddCurrencyToCommons < ActiveRecord::Migration[4.2]