CVE-2022-39398: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: tasklists is a tasklists plugin for GLPI (Kanban). Versions prior to 2.0.3 are vulnerable to Cross-site Scripting. Cross-site Scripting (XSS) - Create XSS in task content (when add it). This issue is patched in version 2.0.3. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-10T01:15Z
Repository: https://github.com/InfotelGLPI/tasklists
Language: PHP
Files changed: inc/task.class.php, inc/tasktype.class.php, setup.php, tasklists.xml
Commit date: 2022-11-08 13:59:40 +0100
Commit message: Fix XSS payload (add script into content)
Bump version

Diff: diff --git a/inc/task.class.php b/inc/task.class.php
index 9940dfb..a1610ac 100644
--- a/inc/task.class.php
+++ b/inc/task.class.php
@@ -330,13 +330,18 @@ class PluginTasklistsTask extends CommonDBTM {
     *
     * @return datas
     */
    function prepareInputForAdd($input) {
 
+
       if (isset($input['due_date']) && empty($input['due_date'])) {
          $input['due_date'] = 'NULL';
       }
+       if (isset($input['content'])) {
+        $input['content'] = Glpi\RichText\RichText::getSafeHtml($input['content'], true);
+       }
+
       if (isset($input["id"]) && ($input["id"] > 0)) {
          $input["_oldID"] = $input["id"];
       }
       unset($input['id']);
 
diff --git a/inc/tasktype.class.php b/inc/tasktype.class.php
index d473e5e..719d401 100644
--- a/inc/tasktype.class.php
+++ b/inc/tasktype.class.php
@@ -267,11 +267,11 @@ class PluginTasklistsTaskType extends CommonTreeDropdown {
                $bgcolor      = $_SESSION["glpipriority_" . $data['priority']];
                $content      .= __('Priority') . "&nbsp;:&nbsp;<i class='fas fa-circle' style='color: $bgcolor'></i>&nbsp;" . CommonITILObject::getPriorityName($data['priority']);
                $content      .= "</div>";
                $rich_content = "";
                if ($data['content'] != null) {
-                  $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true);
+                  $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true, true);
                }
                $content .= Html::resume_text($rich_content, 100);
                $content .= "</div>";
                $content .= "<div align='right' class='endfooter b'>" . $client . "</div>";
                $content .= "<div align='right' class='endfooter'>" . $actiontime . "</div>";
diff --git a/setup.php b/setup.php
index b03a749..3ebcd37 100644
--- a/setup.php
+++ b/setup.php
@@ -25,11 +25,11 @@
  You should have received a copy of the GNU General Public License
  along with Tasklists. If not, see <http://www.gnu.org/licenses/>.
  --------------------------------------------------------------------------
  */
 
-define('PLUGIN_TASKLISTS_VERSION', '2.0.2');
+define('PLUGIN_TASKLISTS_VERSION', '2.0.3');
 
 if (!defined("PLUGIN_TASKLISTS_DIR")) {
    define("PLUGIN_TASKLISTS_DIR", Plugin::getPhpDir("tasklists"));
    define("PLUGIN_TASKLISTS_NOTFULL_DIR", Plugin::getPhpDir("tasklists",false));
    define("PLUGIN_TASKLISTS_WEBDIR", Plugin::getWebDir("tasklists"));
diff --git a/tasklists.xml b/tasklists.xml
index 49373e9..2b10447 100644
--- a/tasklists.xml
+++ b/tasklists.xml
@@ -23,10 +23,15 @@
     <authors>
         <author>Xavier Caillaud</author>
         <author>Infotel</author>
     </authors>
     <versions>
+        <version>
+            <num>2.0.3</num>
+            <compatibility>~10.0</compatibility>
+            <download_url>https://github.com/InfotelGLPI/tasklists/releases/download/2.0.3/glpi-tasklists-2.0.3.tar.bz2</download_url>
+        </version>
         <version>
             <num>2.0.2</num>
             <compatibility>~10.0</compatibility>
             <download_url>https://github.com/InfotelGLPI/tasklists/releases/download/2.0.2/glpi-tasklists-2.0.2.tar.bz2</download_url>
         </version>

Vulnerable code:                   $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true);
define('PLUGIN_TASKLISTS_VERSION', '2.0.2');
Fixed code: 
       if (isset($input['content'])) {
        $input['content'] = Glpi\RichText\RichText::getSafeHtml($input['content'], true);
       }

                  $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true, true);
define('PLUGIN_TASKLISTS_VERSION', '2.0.3');
        <version>
            <num>2.0.3</num>
            <compatibility>~10.0</compatibility>
            <download_url>https://github.com/InfotelGLPI/tasklists/releases/download/2.0.3/glpi-tasklists-2.0.3.tar.bz2</download_url>
        </version>