CVE-2023-3552: Improper Encoding or Escaping of Output (CWE-116)
value: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 5.4
Published: 2023-07-08T09:15Z
Repository: https://github.com/nilsteampassnet/teampass
Language: PHP
Files changed: includes/js/functions.js, pages/folders.js.php
Commit date: 2023-07-08 10:17:10 +0200
Commit message: 3.0.10

Fix possible xss in folder page

Diff: diff --git a/includes/js/functions.js b/includes/js/functions.js
index 8d06dc008b..e394e64a92 100755
--- a/includes/js/functions.js
+++ b/includes/js/functions.js
@@ -395,26 +395,30 @@ function simplePurifier(
     bHtml = false,
     bSvg = false,
     bSvgFilters = false
 ) 
 {
-    return DOMPurify.sanitize(
-        sanitizeDom(text)
-            .replaceAll('&lt;', '<')
-            .replaceAll('&#x3C;', '<')
-            .replaceAll('&#60;', '<')
-            .replaceAll('&gt;', '>')
-            .replaceAll('&#x3E;', '>')
-            .replaceAll('&#62;', '>')
-            .replaceAll('&amp;', '&')
-            .replaceAll('&#38;', '&')
-            .replaceAll('&#x26;', '&')
-            .replaceAll('&quot;', '"')
-            .replaceAll('&#34;;', '"')
-            .replaceAll('&#x22;', '"')
-            .replaceAll('&#39;', "'"),
-        {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
+    return sanitizeDom(
+        DOMPurify.sanitize(
+            text
+                .replaceAll('&lt;', '<')
+                .replaceAll('&#x3C;', '<')
+                .replaceAll('&#x3c;', '<')
+                .replaceAll('&#60;', '<')
+                .replaceAll('&gt;', '>')
+                .replaceAll('&#x3E;', '>')
+                .replaceAll('&#x3e;', '>')
+                .replaceAll('&#62;', '>')
+                .replaceAll('&amp;', '&')
+                .replaceAll('&#38;', '&')
+                .replaceAll('&#x26;', '&')
+                .replaceAll('&quot;', '"')
+                .replaceAll('&#34;;', '"')
+                .replaceAll('&#x22;', '"')
+                .replaceAll('&#39;', "'"),
+            {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
+        )
     );
 }
 
 /**
  * Permits to purify the content of a string using domPurify
diff --git a/pages/folders.js.php b/pages/folders.js.php
index adcfb3bb3d..69a92257cf 100755
--- a/pages/folders.js.php
+++ b/pages/folders.js.php
@@ -115,10 +115,11 @@ if (checkUser($_SESSION['user_id'], $_SESSION['key'], 'folders', $SETTINGS) ===
                 'editRestriction': $('#new-edit-restriction').prop("checked") === true ? 1 : 0,
                 'icon': purifyRes.arrFields['icon'],
                 'iconSelected': purifyRes.arrFields['iconSelected'],
             }
             console.log(data)
+            return false;
             // Launch action
             $.post(
                 'sources/folders.queries.php', {
                     type: 'add_folder',
                     data: prepareExchangedData(JSON.stringify(data), "encode", "<?php echo $_SESSION['key']; ?>"),

Vulnerable code:     return DOMPurify.sanitize(
        sanitizeDom(text)
            .replaceAll('&lt;', '<')
            .replaceAll('&#x3C;', '<')
            .replaceAll('&#60;', '<')
            .replaceAll('&gt;', '>')
            .replaceAll('&#x3E;', '>')
            .replaceAll('&#62;', '>')
            .replaceAll('&amp;', '&')
            .replaceAll('&#38;', '&')
            .replaceAll('&#x26;', '&')
            .replaceAll('&quot;', '"')
            .replaceAll('&#34;;', '"')
            .replaceAll('&#x22;', '"')
            .replaceAll('&#39;', "'"),
        {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
Fixed code:     return sanitizeDom(
        DOMPurify.sanitize(
            text
                .replaceAll('&lt;', '<')
                .replaceAll('&#x3C;', '<')
                .replaceAll('&#x3c;', '<')
                .replaceAll('&#60;', '<')
                .replaceAll('&gt;', '>')
                .replaceAll('&#x3E;', '>')
                .replaceAll('&#x3e;', '>')
                .replaceAll('&#62;', '>')
                .replaceAll('&amp;', '&')
                .replaceAll('&#38;', '&')
                .replaceAll('&#x26;', '&')
                .replaceAll('&quot;', '"')
                .replaceAll('&#34;;', '"')
                .replaceAll('&#x22;', '"')
                .replaceAll('&#39;', "'"),
            {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
        )
            return false;