CVE-2012-6620: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-01-16T21:55Z
Repository: https://github.com/horde/horde
Language: Other
Files changed: kronolith/docs/CHANGES, kronolith/js/kronolith.js, kronolith/package.xml
Commit date: 2012-05-12 13:33:23 +0200
Commit message: Escape content (Bug #11189).

Diff: diff --git a/kronolith/docs/CHANGES b/kronolith/docs/CHANGES
index 4f9e12c754..1bba57cadb 100644
--- a/kronolith/docs/CHANGES
+++ b/kronolith/docs/CHANGES
@@ -1,9 +1,11 @@
 -----------
 v3.0.17-git
 -----------
 
+[jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug
+      #11189).
 [jan] Update Italian translation (Massimo Malabotta <mmalabotta@units.it>).
 [jan] Improve print styles.
 [jan] Catch if external client doesn't send LAST-MODIFIED attributes (Bug
       #11130).
 [jan] Don't stop agenda script if there is an error with a single user (Bug
diff --git a/kronolith/js/kronolith.js b/kronolith/js/kronolith.js
index 8059ebd232..3dfa6e7b6e 100644
--- a/kronolith/js/kronolith.js
+++ b/kronolith/js/kronolith.js
@@ -192,11 +192,11 @@ KronolithCore = {
                 }
                 message = new Element('div')
                     .insert(message);
                 if (alarm.params && alarm.params.notify &&
                     alarm.params.notify.subtitle) {
-                    message.insert(new Element('br')).insert(alarm.params.notify.subtitle);
+                    message.insert(new Element('br')).insert(alarm.params.notify.subtitle.escapeHTML());
                 }
                 if (alarm.user) {
                     var select = '<select>';
                     $H(Kronolith.conf.snooze).each(function(snooze) {
                         select += '<option value="' + snooze.key + '">' + snooze.value + '</option>';
@@ -809,11 +809,11 @@ KronolithCore = {
         case 'agenda':
             var dates = this.viewDates(date, view);
             return this.setTitle(Kronolith.text.agenda + ' ' + dates[0].toString(Kronolith.conf.date_format) + ' - ' + dates[1].toString(Kronolith.conf.date_format));
 
         case 'search':
-            return this.setTitle(Kronolith.text.searching.interpolate({ term: data }));
+            return this.setTitle(Kronolith.text.searching.interpolate({ term: data })).escapeHTML();
         }
     },
 
     /**
      * Closes the currently active view.
@@ -2492,11 +2492,11 @@ KronolithCore = {
             col.insert(new Element('span', { className: 'kronolithDate' }).update(task.value.due.toString(Kronolith.conf.date_format)));
         }
 
         if (!Object.isUndefined(task.value.sd)) {
             col.insert(new Element('span', { className: 'kronolithSeparator' }).update(' &middot; '));
-            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd));
+            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd.escapeHTML()));
         }
 
         row.insert(col.show());
         this.insertTaskPosition(row, task);
     },
@@ -2986,11 +2986,11 @@ KronolithCore = {
                         return;
                     }
                     $('kronolithCalendarholidayDriver').insert(
                         new Element('option', { value: calendar.name })
                             .setStyle({ color: calendar.fg, backgroundColor: calendar.bg })
-                            .insert(calendar.name)
+                            .insert(calendar.name.escapeHTML())
                     );
                 });
                 break;
             }
             $('kronolithCalendar' + type + 'Id').clear();
@@ -5327,11 +5327,11 @@ KronolithCore = {
 
         /* Basic information */
         $('kronolithEventId').setValue(ev.id);
         $('kronolithEventCalendar').setValue(ev.ty + '|' + ev.c);
         $('kronolithEventTarget').setValue(ev.ty + '|' + ev.c);
-        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name);
+        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name.escapeHTML());
         $('kronolithEventTitle').setValue(ev.t);
         $('kronolithEventLocation').setValue(ev.l);
         if (ev.l && Kronolith.conf.maps.driver) {
             $('kronolithEventMapLink').show();
         }
diff --git a/kronolith/package.xml b/kronolith/package.xml
index abb7697814..5719c3ef04 100644
--- a/kronolith/package.xml
+++ b/kronolith/package.xml
@@ -32,10 +32,11 @@
   <release>stable</release>
   <api>stable</api>
  </stability>
  <license uri="http://www.horde.org/licenses/gpl">GPL-2.0</license>
  <notes>
+* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).
 * [jan] Update Italian translation (Massimo Malabotta &lt;mmalabotta@units.it&gt;).
 * [jan] Improve print styles.
 * [jan] Catch if external client doesn&apos;t send LAST-MODIFIED attributes (Bug #11130).
 * [jan] Don&apos;t stop agenda script if there is an error with a single user (Bug #11129).
 * [jan] Update Hungarian translation (Zoltán Németh &lt;nemeth.zoltan@etit.hu&gt;).
@@ -2080,10 +2081,11 @@
     <release>stable</release>
     <api>stable</api></stability>
    <date>2012-03-20</date>
    <license uri="http://www.horde.org/licenses/gpl">GPL-2.0</license>
    <notes>
+* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).
 * [jan] Update Italian translation (Massimo Malabotta &lt;mmalabotta@units.it&gt;).
 * [jan] Improve print styles.
 * [jan] Catch if external client doesn&apos;t send LAST-MODIFIED attributes (Bug #11130).
 * [jan] Don&apos;t stop agenda script if there is an error with a single user (Bug #11129).
 * [jan] Update Hungarian translation (Zoltán Németh &lt;nemeth.zoltan@etit.hu&gt;).

Vulnerable code:                     message.insert(new Element('br')).insert(alarm.params.notify.subtitle);
            return this.setTitle(Kronolith.text.searching.interpolate({ term: data }));
            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd));
                            .insert(calendar.name)
        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name);
Fixed code: [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug
      #11189).
                    message.insert(new Element('br')).insert(alarm.params.notify.subtitle.escapeHTML());
            return this.setTitle(Kronolith.text.searching.interpolate({ term: data })).escapeHTML();
            col.insert(new Element('span', { className: 'kronolithInfo' }).update(task.value.sd.escapeHTML()));
                            .insert(calendar.name.escapeHTML())
        $('kronolithEventTargetRO').update(Kronolith.conf.calendars[ev.ty][ev.c].name.escapeHTML());
* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).
* [jan] SECURITY: Fix XSS vulnerabilities in tasks view and search view (Bug #11189).