CVE-2021-4050: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-08T11:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/lib/core/lhcore/lhfileupload.php, lhc_web/lib/core/lhcore/lhfileuploadadmin.php
Commit date: 2021-12-07 08:10:30 -0500
Commit message: Clean SVG and adjust file size

Diff: diff --git a/lhc_web/lib/core/lhcore/lhfileupload.php b/lhc_web/lib/core/lhcore/lhfileupload.php
index a837454b2..92980d6f5 100644
--- a/lhc_web/lib/core/lhcore/lhfileupload.php
+++ b/lhc_web/lib/core/lhcore/lhfileupload.php
@@ -69,14 +69,19 @@ class erLhcoreClassFileUpload extends UploadHandler
                 $fileUpload->online_user_id = $this->options['online_user']->id;
             }
 
             $matches = array();
             if (strpos($name, '.') === false && preg_match('/^image\/(gif|jpe?g|png)/', $fileUpload->type, $matches)) {
-                $fileUpload->extension = $matches[1];
+                $fileUpload->extension = strtolower($matches[1]);
             } else {
                 $partsFile = explode('.', $fileUpload->upload_name);
-                $fileUpload->extension = end($partsFile);
+                $fileUpload->extension = strtolower(end($partsFile));
+            }
+
+            if ($fileUpload->extension == 'svg') {
+                erLhcoreClassFileUploadAdmin::cleanSVG($fileUpload->file_path_server);
+                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
             }
 
             if (isset($this->options['remove_meta']) && $this->options['remove_meta'] == true && in_array($fileUpload->extension, array('jpg', 'jpeg', 'png', 'gif'))) {
                 erLhcoreClassFileUploadAdmin::removeExif($fileUpload->file_path_server, $fileUpload->file_path_server . '_exif');
                 unlink($fileUpload->file_path_server);
diff --git a/lhc_web/lib/core/lhcore/lhfileuploadadmin.php b/lhc_web/lib/core/lhcore/lhfileuploadadmin.php
index 528c2d261..71ca17fb2 100644
--- a/lhc_web/lib/core/lhcore/lhfileuploadadmin.php
+++ b/lhc_web/lib/core/lhcore/lhfileuploadadmin.php
@@ -71,15 +71,20 @@ class erLhcoreClassFileUploadAdmin extends erLhcoreClassFileUpload
             } else {
                 $partsFile = explode('.', $name);
                 $fileUpload->extension = strtolower(end($partsFile));
             }
 
+            if ($fileUpload->extension == 'svg') {
+                self::cleanSVG($fileUpload->file_path_server);
+                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
+            }
+
             if (isset($this->options['remove_meta']) && $this->options['remove_meta'] == true && in_array($fileUpload->extension, array('jpg', 'jpeg', 'png', 'gif'))) {
                 self::removeExif($fileUpload->file_path_server, $fileUpload->file_path_server . '_exif');
                 unlink($fileUpload->file_path_server);
                 rename($fileUpload->file_path_server . '_exif', $fileUpload->file_path_server);
-                $fileUpload->size = filesize($fileUpload->file_path_server);
+                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
             }
 
             $fileUpload->saveThis();
 
             $this->uploadedFile = $fileUpload;
@@ -87,8 +92,18 @@ class erLhcoreClassFileUploadAdmin extends erLhcoreClassFileUpload
             throw new Exception($file->error);
         }
 
         return $file;
     }
+
+    public static function cleanSVG($path)
+    {
+        $sanitizer = new \enshrined\svgSanitize\Sanitizer();
+        $dirtySVG = file_get_contents($path);
+        $cleanSVG = $sanitizer->sanitize($dirtySVG);
+        file_put_contents($path.'_svg', $cleanSVG);
+        unlink($path);
+        rename($path.'_svg', $path);
+    }
 }
 
 ?>
\ No newline at end of file

Vulnerable code:                 $fileUpload->extension = $matches[1];
                $fileUpload->extension = end($partsFile);
                $fileUpload->size = filesize($fileUpload->file_path_server);
Fixed code:                 $fileUpload->extension = strtolower($matches[1]);
                $fileUpload->extension = strtolower(end($partsFile));
            }

            if ($fileUpload->extension == 'svg') {
                erLhcoreClassFileUploadAdmin::cleanSVG($fileUpload->file_path_server);
                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
            if ($fileUpload->extension == 'svg') {
                self::cleanSVG($fileUpload->file_path_server);
                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
            }

                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);

    public static function cleanSVG($path)
    {
        $sanitizer = new \enshrined\svgSanitize\Sanitizer();
        $dirtySVG = file_get_contents($path);
        $cleanSVG = $sanitizer->sanitize($dirtySVG);
        file_put_contents($path.'_svg', $cleanSVG);
        unlink($path);
        rename($path.'_svg', $path);
    }