CVE-2024-34699: Insufficient Information (NVD-CWE-noinfo)
value: GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in `v0.20.1`.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:39Z
Repository: https://github.com/GZTimeWalker/GZCTF
Language: CSS
Files changed: src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx, src/GZCTF/ClientApp/src/styles/shared/Typography.module.css
Commit date: 2024-05-11 18:47:08 +0800
Commit message: fix(security): html injection by team name

Diff: diff --git a/src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx b/src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx
index 82456d87..6b19d080 100644
--- a/src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx
+++ b/src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx
@@ -19,10 +19,11 @@ import { useTranslation } from 'react-i18next'
 import { useParams } from 'react-router-dom'
 import Empty from '@Components/Empty'
 import { InlineMarkdownRender } from '@Components/MarkdownRender'
 import { NoticTypeIconMap } from '@Utils/Shared'
 import api, { GameNotice, NoticeType } from '@Api'
+import classes from '@Styles/Typography.module.css'
 
 enum NoticeFilter {
   All = 'all',
   Challenge = 'challenge',
   Events = 'events',
@@ -203,16 +204,22 @@ const GameNoticePanel: FC = () => {
                 >
                   <Stack gap={1}>
                     <Text fz="xs" fw="bold" c="dimmed">
                       {dayjs(notice.time).format('YY/MM/DD HH:mm:ss')}
                     </Text>
-                    <InlineMarkdownRender
-                      fz="sm"
-                      fw={500}
-                      c="dimmed"
-                      source={formatNotice(t, notice)}
-                    />
+                    {notice.type === NoticeType.Normal ? (
+                      <InlineMarkdownRender
+                        fz="sm"
+                        fw={500}
+                        c="dimmed"
+                        source={formatNotice(t, notice)}
+                      />
+                    ) : (
+                      <Text fz="sm" fw={500} c="dimmed" className={classes.inline}>
+                        {formatNotice(t, notice)}
+                      </Text>
+                    )}
                   </Stack>
                 </List.Item>
               ))}
             </List>
           </ScrollArea>
diff --git a/src/GZCTF/ClientApp/src/styles/shared/Typography.module.css b/src/GZCTF/ClientApp/src/styles/shared/Typography.module.css
index c6a8e422..a03e4cef 100644
--- a/src/GZCTF/ClientApp/src/styles/shared/Typography.module.css
+++ b/src/GZCTF/ClientApp/src/styles/shared/Typography.module.css
@@ -162,12 +162,13 @@
     }
   }
 }
 
 .inline {
-  word-break: break-word;
+  word-break: break-all;
   word-wrap: break-word;
+  white-space: pre-wrap;
 
   & code {
     white-space: normal;
     font-weight: 500;
     background-color: transparent;

Vulnerable code:                     <InlineMarkdownRender
                      fz="sm"
                      fw={500}
                      c="dimmed"
                      source={formatNotice(t, notice)}
                    />
  word-break: break-word;
Fixed code: import classes from '@Styles/Typography.module.css'
                    {notice.type === NoticeType.Normal ? (
                      <InlineMarkdownRender
                        fz="sm"
                        fw={500}
                        c="dimmed"
                        source={formatNotice(t, notice)}
                      />
                    ) : (
                      <Text fz="sm" fw={500} c="dimmed" className={classes.inline}>
                        {formatNotice(t, notice)}
                      </Text>
                    )}
  word-break: break-all;
  white-space: pre-wrap;