CVE-2023-0880: Misinterpretation of Input (CWE-115)
value: Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CVSS v3 base score: 4.3
Published: 2023-02-17T03:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php
Commit date: 2023-01-27 18:02:47 +0100
Commit message: fix: added trim to avoid questions with a single space

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 5d1b54a63c..d175fe3764 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -315,25 +315,25 @@ switch ($action) {
 
         $faq = new Faq($faqConfig);
         $category = new Category($faqConfig);
         $questionObject = new Question($faqConfig);
 
-        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
-        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
+        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
         $faqId = Filter::filterInput(INPUT_POST, 'faqid', FILTER_VALIDATE_INT);
         $faqLanguage = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
-        $question = strip_tags($question);
+        $question = trim(strip_tags($question));
         if ($faqConfig->get('main.enableWysiwygEditorFrontend')) {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_SANITIZE_SPECIAL_CHARS);
-            $answer = html_entity_decode($answer);
+            $answer = trim(html_entity_decode($answer));
         } else {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_UNSAFE_RAW);
             $answer = strip_tags($answer);
-            $answer = nl2br($answer);
+            $answer = trim(nl2br($answer));
         }
-        $translatedAnswer = Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW);
+        $translatedAnswer = trim(Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW));
         $contentLink = Filter::filterInput(INPUT_POST, 'contentlink', FILTER_UNSAFE_RAW);
         $contentLink = Filter::filterVar($contentLink, FILTER_VALIDATE_URL);
         $keywords = Filter::filterInput(INPUT_POST, 'keywords', FILTER_UNSAFE_RAW);
         $categories = Filter::filterInputArray(
             INPUT_POST,
@@ -476,15 +476,15 @@ switch ($action) {
         }
 
         $faq = new Faq($faqConfig);
         $cat = new Category($faqConfig);
         $categories = $cat->getAllCategories();
-        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
-        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
+        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
         $ucategory = Filter::filterInput(INPUT_POST, 'category', FILTER_VALIDATE_INT);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
-        $question = strip_tags($question);
+        $question = trim(strip_tags($question));
         $save = Filter::filterInput(INPUT_POST, 'save', FILTER_VALIDATE_INT, 0);
 
         // If e-mail address is set to optional
         if (!$faqConfig->get('main.optionalMailAddress') && is_null($email)) {
             $email = $faqConfig->getAdminEmail();

Vulnerable code:         $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
        $question = strip_tags($question);
            $answer = html_entity_decode($answer);
            $answer = nl2br($answer);
        $translatedAnswer = Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW);
        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
        $question = strip_tags($question);
Fixed code:         $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
        $question = trim(strip_tags($question));
            $answer = trim(html_entity_decode($answer));
            $answer = trim(nl2br($answer));
        $translatedAnswer = trim(Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW));
        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
        $question = trim(strip_tags($question));