CVE-2023-7166: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-29T09:15Z
Repository: https://github.com/201206030/novel-plus
Language: Java
Files changed: novel-common/src/main/java/com/java2nb/novel/entity/User.java
Commit date: 2023-12-29 00:11:01 +0800
Commit message: fix: nickName、userPhoto 更新校验

Diff: diff --git a/novel-common/src/main/java/com/java2nb/novel/entity/User.java b/novel-common/src/main/java/com/java2nb/novel/entity/User.java
index fd3805e..04b93af 100644
--- a/novel-common/src/main/java/com/java2nb/novel/entity/User.java
+++ b/novel-common/src/main/java/com/java2nb/novel/entity/User.java
@@ -12,47 +12,52 @@ public class User {
     @Null(groups = {AddGroup.class, UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Long id;
 
 
-    @NotBlank(groups = {AddGroup.class},message="手机号不能为空！")
-    @Pattern(groups = {AddGroup.class},regexp="^1[3|4|5|6|7|8|9][0-9]{9}$",message="手机号格式不正确！")
+    @NotBlank(groups = {AddGroup.class}, message = "手机号不能为空！")
+    @Pattern(groups = {AddGroup.class}, regexp = "^1[3|4|5|6|7|8|9][0-9]{9}$", message = "手机号格式不正确！")
+    @Null(groups = {UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private String username;
 
-    @NotBlank(groups = {AddGroup.class},message="密码不能为空！")
+    @NotBlank(groups = {AddGroup.class}, message = "密码不能为空！")
     @Null(groups = {UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private String password;
 
     @Null(groups = {AddGroup.class})
+    @Pattern(groups = {
+        UpdateGroup.class}, regexp = "[\u4E00-\u9FA5A-Za-z0-9_]{1,20}", message = "昵称格式不正确！")
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private String nickName;
 
     @Null(groups = {AddGroup.class})
+    @Pattern(groups = {
+        UpdateGroup.class}, regexp = "^/localPic/\\d{4}/\\d{2}/\\d{2}/[A-Za-z0-9]+\\.(jpg|jpeg|swf|gif|png|JPG|JPEG|SWF|GIF|PNG)$", message = "只能上传图片格式的文件！")
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private String userPhoto;
 
     @Null(groups = {AddGroup.class})
-    @Min(value = 0,groups = {UpdateGroup.class})
-    @Max(value = 1,groups = {UpdateGroup.class})
+    @Min(value = 0, groups = {UpdateGroup.class})
+    @Max(value = 1, groups = {UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Byte userSex;
 
-    @Null(groups = {AddGroup.class,UpdateGroup.class})
+    @Null(groups = {AddGroup.class, UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Long accountBalance;
 
-    @Null(groups = {AddGroup.class,UpdateGroup.class})
+    @Null(groups = {AddGroup.class, UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Byte status;
 
-    @Null(groups = {AddGroup.class,UpdateGroup.class})
+    @Null(groups = {AddGroup.class, UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Date createTime;
 
-    @Null(groups = {AddGroup.class,UpdateGroup.class})
+    @Null(groups = {AddGroup.class, UpdateGroup.class})
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     private Date updateTime;
 
     @Generated("org.mybatis.generator.api.MyBatisGenerator")
     public Long getId() {

Vulnerable code:     @NotBlank(groups = {AddGroup.class},message="手机号不能为空！")
    @Pattern(groups = {AddGroup.class},regexp="^1[3|4|5|6|7|8|9][0-9]{9}$",message="手机号格式不正确！")
    @NotBlank(groups = {AddGroup.class},message="密码不能为空！")
    @Min(value = 0,groups = {UpdateGroup.class})
    @Max(value = 1,groups = {UpdateGroup.class})
    @Null(groups = {AddGroup.class,UpdateGroup.class})
    @Null(groups = {AddGroup.class,UpdateGroup.class})
    @Null(groups = {AddGroup.class,UpdateGroup.class})
    @Null(groups = {AddGroup.class,UpdateGroup.class})
Fixed code:     @NotBlank(groups = {AddGroup.class}, message = "手机号不能为空！")
    @Pattern(groups = {AddGroup.class}, regexp = "^1[3|4|5|6|7|8|9][0-9]{9}$", message = "手机号格式不正确！")
    @Null(groups = {UpdateGroup.class})
    @NotBlank(groups = {AddGroup.class}, message = "密码不能为空！")
    @Pattern(groups = {
        UpdateGroup.class}, regexp = "[\u4E00-\u9FA5A-Za-z0-9_]{1,20}", message = "昵称格式不正确！")
    @Pattern(groups = {
        UpdateGroup.class}, regexp = "^/localPic/\\d{4}/\\d{2}/\\d{2}/[A-Za-z0-9]+\\.(jpg|jpeg|swf|gif|png|JPG|JPEG|SWF|GIF|PNG)$", message = "只能上传图片格式的文件！")
    @Min(value = 0, groups = {UpdateGroup.class})
    @Max(value = 1, groups = {UpdateGroup.class})
    @Null(groups = {AddGroup.class, UpdateGroup.class})
    @Null(groups = {AddGroup.class, UpdateGroup.class})
    @Null(groups = {AddGroup.class, UpdateGroup.class})
    @Null(groups = {AddGroup.class, UpdateGroup.class})