CVE-2019-13970: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-19T06:15Z
Repository: https://github.com/AntSwordProject/antSword
Language: JavaScript
Files changed: CHANGELOG.md, source/modules/database/asp/index.js, source/modules/database/custom/index.js, source/modules/database/index.js, source/modules/database/php/index.js
Commit date: 2019-04-18 21:36:30 +0800
Commit message: (Fix: Database) fix #151 (thx @miaochiahao)

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6c8dcf7..f28dbda5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,11 @@
 > 有空会补补BUG、添添新功能。    
 > 同时也欢迎大家的参与！感谢各位朋友的支持！ .TAT.
 ## `v(2.0.7.3)
 
 * 主窗口增加 CSP 策略
+* Fix self-xss in database config #151 (thx @miaochiahao)
 
 ## `v(2.0.7.2)`
 
 * Fix #150 文件路径输入框未过滤问题
 * 修复目录树双击时引起console下报错问题
diff --git a/source/modules/database/asp/index.js b/source/modules/database/asp/index.js
index 7d1666cb..19916fbd 100644
--- a/source/modules/database/asp/index.js
+++ b/source/modules/database/asp/index.js
@@ -137,11 +137,11 @@ class ASP {
     let items = [];
     for (let _ in conf) {
       items.push({
         id: `conn::${_}`,
         // text: `${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`,
-        text: conf[_]['type'].toUpperCase(),
+        text: antSword.noxss(conf[_]['type'].toUpperCase()),
         im0: this.manager.list.imgs[0],
         im1: this.manager.list.imgs[0],
         im2: this.manager.list.imgs[0]
       });
     }
diff --git a/source/modules/database/custom/index.js b/source/modules/database/custom/index.js
index 5da18ec7..50249d96 100644
--- a/source/modules/database/custom/index.js
+++ b/source/modules/database/custom/index.js
@@ -122,11 +122,11 @@ class CUSTOM {
     let items = [];
     for (let _ in conf) {
       items.push({
         id: `conn::${_}`,
         // text: `${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`,
-        text: conf[_]['type'].toUpperCase(),
+        text: antSword.noxss(conf[_]['type'].toUpperCase()),
         im0: this.manager.list.imgs[0],
         im1: this.manager.list.imgs[0],
         im2: this.manager.list.imgs[0]
       });
     }
diff --git a/source/modules/database/index.js b/source/modules/database/index.js
index b6bc01cc..26690593 100644
--- a/source/modules/database/index.js
+++ b/source/modules/database/index.js
@@ -249,11 +249,11 @@ class Database {
         let item = _data[i].split('\t');
         if(item.length<2){continue;}
         data_arr.push({
           id: i+1,
           data: [
-            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : item[0],
+            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : antSword.noxss(item[0]),
             parseInt(item[1]) === 1 ? "√" : "×",
           ],
           style: parseInt(item[1]) === 1 ? "background-color:#ADF1B9": "",
         });
       }
diff --git a/source/modules/database/php/index.js b/source/modules/database/php/index.js
index 42ac90f8..60c91437 100644
--- a/source/modules/database/php/index.js
+++ b/source/modules/database/php/index.js
@@ -286,11 +286,11 @@ class PHP {
     // 2.添加数据
     let items = [];
     for (let _ in conf) {
       items.push({
         id: `conn::${_}`,
-        text: `${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`,
+        text: antSword.noxss(`${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`),
         im0: this.manager.list.imgs[0],
         im1: this.manager.list.imgs[0],
         im2: this.manager.list.imgs[0]
       });
     }

Vulnerable code:         text: conf[_]['type'].toUpperCase(),
        text: conf[_]['type'].toUpperCase(),
            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : item[0],
        text: `${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`,
Fixed code: * Fix self-xss in database config #151 (thx @miaochiahao)
        text: antSword.noxss(conf[_]['type'].toUpperCase()),
        text: antSword.noxss(conf[_]['type'].toUpperCase()),
            func_mapping.hasOwnProperty(item[0]) ? func_mapping[item[0]] : antSword.noxss(item[0]),
        text: antSword.noxss(`${conf[_]['type']}:\/\/${conf[_]['user']}@${conf[_]['host']}`),