CVE-2019-14330: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-28T14:15Z
Repository: https://github.com/espocrm/espocrm
Language: JavaScript
Files changed: client/src/views/email/fields/email-address-varchar.js, client/src/views/email/fields/from-address-varchar.js, client/src/views/fields/link-multiple-with-primary.js, client/src/views/notification/items/assign.js, client/src/views/notification/items/email-received.js, client/src/views/notification/items/entity-removed.js, client/src/views/notification/items/message.js, client/src/views/site/navbar.js, client/src/views/stream/note.js, client/src/views/stream/notes/assign.js, client/src/views/stream/notes/create-related.js, client/src/views/stream/notes/create.js, client/src/views/stream/notes/email-received.js, client/src/views/stream/notes/email-sent.js, client/src/views/stream/notes/mention-in-post.js, client/src/views/stream/notes/post.js, client/src/views/stream/notes/relate.js, client/src/views/stream/notes/status.js
Commit date: 2019-07-23 17:50:02 +0300
Commit message: xss fixes

Diff: diff --git a/client/src/views/email/fields/email-address-varchar.js b/client/src/views/email/fields/email-address-varchar.js
index 16bde39ac..6fdb69540 100644
--- a/client/src/views/email/fields/email-address-varchar.js
+++ b/client/src/views/email/fields/email-address-varchar.js
@@ -201,10 +201,14 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
 
             return true;
         },
 
         addAddress: function (address, name, type, id) {
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             if (this.justAddedAddress) {
                 this.deleteAddress(this.justAddedAddress);
             }
             this.justAddedAddress = address;
             setTimeout(function () {
@@ -234,10 +238,17 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
                 this.trigger('change');
             }
         },
 
         addAddressHtml: function (address, name) {
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+            if (address) {
+                name = this.getHelper().escapeString(address);
+            }
+
             var conteiner = this.$el.find('.link-container');
             var html =
             '<div data-address="'+address+'" class="list-group-item">' +
                 '<a href="javascript:" class="pull-right" data-address="' + address + '" data-action="clearAddress"><span class="fas fa-times"></a>' +
                 '<span>'+ ((name) ? (name + ' <span class="text-muted">&#187;</span> ') : '') + '<span>'+address+'</span>'+'</span>' +
@@ -286,10 +297,14 @@ Espo.define('views/email/fields/email-address-varchar', ['views/fields/varchar',
             var entityType = this.typeHash[address] || null;
             var id = this.idHash[address] || null;
 
             var addressHtml = '<span>' + address + '</span>';
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var lineHtml;
             if (id) {
                 lineHtml = '<div>' + '<a href="#' + entityType + '/view/' + id + '">' + name + '</a> <span class="text-muted">&#187;</span> ' + addressHtml + '</div>';
             } else {
                 if (name) {
diff --git a/client/src/views/email/fields/from-address-varchar.js b/client/src/views/email/fields/from-address-varchar.js
index 7ee43b331..8c12df447 100644
--- a/client/src/views/email/fields/from-address-varchar.js
+++ b/client/src/views/email/fields/from-address-varchar.js
@@ -104,10 +104,15 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
             }
 
             var fromString = this.model.get('fromString') || this.model.get('fromName');
 
             var name = this.nameHash[address] || this.parseNameFromStringAddress(fromString) || null;
+
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var entityType = this.typeHash[address] || null;
             var id = this.idHash[address] || null;
 
             var addressHtml = '<span>' + address + '</span>';
 
@@ -127,10 +132,12 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
             lineHtml = '<div>' + lineHtml + '</div>';
             return lineHtml;
         },
 
         getCreateHtml: function (address) {
+            address = this.getHelper().escapeString(address);
+
             var html = '<span class="dropdown email-address-create-dropdown pull-right">' +
                 '<button class="dropdown-toggle btn btn-link btn-sm" data-toggle="dropdown">' +
                     '<span class="caret text-muted"></span>' +
                 '</button>' +
                 '<ul class="dropdown-menu" role="menu">' +
@@ -177,10 +184,14 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
                 if (this.name == 'from') {
                     name = this.parseNameFromStringAddress(fromString) || null;
                 }
             }
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var attributes = {
                 emailAddress: address
             };
 
             if (this.model.get('accountId') && scope == 'Contact') {
@@ -238,10 +249,14 @@ Espo.define('views/email/fields/from-address-varchar', 'views/fields/varchar', f
                 if (this.name == 'from') {
                     name = this.parseNameFromStringAddress(fromString) || null;
                 }
             }
 
+            if (name) {
+                name = this.getHelper().escapeString(name);
+            }
+
             var attributes = {
                 emailAddress: address
             };
 
             if (this.model.get('accountId') && scope == 'Contact') {
diff --git a/client/src/views/fields/link-multiple-with-primary.js b/client/src/views/fields/link-multiple-with-primary.js
index eb9914465..c79047833 100644
--- a/client/src/views/fields/link-multiple-with-primary.js
+++ b/client/src/views/fields/link-multiple-with-primary.js
@@ -128,11 +128,11 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
             }
 
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role clearfix link-group-item-with-primary">').addClass('link-' + id).attr('data-id', id);
 
-            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + this.getHelper().escapeString(name) + '&nbsp;' + '</div>';
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
             $left = $('<div>');
             $left.append(nameHtml);
             $el.append($left);
diff --git a/client/src/views/notification/items/assign.js b/client/src/views/notification/items/assign.js
index e8de5a005..4469acda7 100644
--- a/client/src/views/notification/items/assign.js
+++ b/client/src/views/notification/items/assign.js
@@ -38,11 +38,11 @@ Espo.define('views/notification/items/assign', 'views/notification/items/base',
             var data = this.model.get('data') || {};
 
             this.userId = data.userId;
 
             this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
-            this.messageData['entity'] = '<a href="#' + data.entityType + '/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['entity'] = '<a href="#' + this.getHelper().escapeString(data.entityType) + '/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         },
 
     });
diff --git a/client/src/views/notification/items/email-received.js b/client/src/views/notification/items/email-received.js
index 8f6fa64d2..fb0f59e71 100644
--- a/client/src/views/notification/items/email-received.js
+++ b/client/src/views/notification/items/email-received.js
@@ -44,21 +44,20 @@ Espo.define('views/notification/items/email-received', 'views/notification/items
         setup: function () {
             var data = this.model.get('data') || {};
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
+            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
             if (data.personEntityId) {
-                this.messageData['from'] = '<a href="#' + data.personEntityType + '/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+                this.messageData['from'] = '<a href="#' + this.getHelper().escapeString(data.personEntityType) + '/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
             } else {
-                this.messageData['from'] = data.fromString || this.translate('empty address');
+                this.messageData['from'] = this.getHelper().escapeString(data.fromString || this.translate('empty address'));
             }
 
-            this.emailId = data.emailId;
-            this.emailName = data.emailName;
+            this.emailId = this.getHelper().escapeString(data.emailId);
+            this.emailName = this.getHelper().escapeString(data.emailName);
 
             this.createMessage();
         }
 
     });
 });
-
diff --git a/client/src/views/notification/items/entity-removed.js b/client/src/views/notification/items/entity-removed.js
index 217dd4161..ca2e54fbd 100644
--- a/client/src/views/notification/items/entity-removed.js
+++ b/client/src/views/notification/items/entity-removed.js
@@ -37,14 +37,14 @@ Espo.define('views/notification/items/entity-removed', 'views/notification/items
         setup: function () {
             var data = this.model.get('data') || {};
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = (this.translate(data.entityType, 'scopeNames') || '').toLowerCase();
+            this.messageData['entityType'] = this.getHelper().escapeString((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
 
-            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
-            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
+            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         }
 
     });
diff --git a/client/src/views/notification/items/message.js b/client/src/views/notification/items/message.js
index a75b2c13f..fa5a88a76 100644
--- a/client/src/views/notification/items/message.js
+++ b/client/src/views/notification/items/message.js
@@ -45,14 +45,14 @@ Espo.define('views/notification/items/message', 'views/notification/items/base',
 
             this.messageTemplate = this.model.get('message') || data.message || '';
 
             this.userId = data.userId;
 
-            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
+            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
 
-            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
-            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
+            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
+            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
 
             this.createMessage();
         }
 
     });
diff --git a/client/src/views/site/navbar.js b/client/src/views/site/navbar.js
index 069b4e01f..25a48a447 100644
--- a/client/src/views/site/navbar.js
+++ b/client/src/views/site/navbar.js
@@ -39,11 +39,10 @@ Espo.define('views/site/navbar', 'view', function (Dep) {
                 tabDefsList: this.tabDefsList,
                 title: this.options.title,
                 menuDataList: this.getMenuDataList(),
                 quickCreateList: this.quickCreateList,
                 enableQuickCreate: this.quickCreateList.length > 0,
-                userName: this.getUser().get('name'),
                 userId: this.getUser().id,
                 logoSrc: this.getLogoSrc()
             };
         },
 
@@ -526,11 +525,11 @@ Espo.define('views/site/navbar', 'view', function (Dep) {
             if (avatarHtml) avatarHtml += ' ';
 
             var list = [
                 {
                     link: '#User/view/' + this.getUser().id,
-                    html: avatarHtml + this.getUser().get('name')
+                    html: avatarHtml + this.getHelper().escapeString(this.getUser().get('name')),
                 },
                 {divider: true}
             ];
 
             if (this.getUser().isAdmin()) {
diff --git a/client/src/views/stream/note.js b/client/src/views/stream/note.js
index 46d74a674..4e2de4304 100644
--- a/client/src/views/stream/note.js
+++ b/client/src/views/stream/note.js
@@ -83,11 +83,11 @@ Espo.define('views/stream/note', 'view', function (Dep) {
             }
 
             this.messageData = {
                 'user': 'field:createdBy',
                 'entity': 'field:parent',
-                'entityType': this.translateEntityType(this.model.get('parentType')),
+                'entityType': this.getHelper().escapeString(this.translateEntityType(this.model.get('parentType'))),
             };
 
             if (!this.options.noEdit && (this.isEditable || this.isRemovable)) {
                 this.createView('right', 'views/stream/row-actions/default', {
                     el: this.options.el + ' .right-container',
diff --git a/client/src/views/stream/notes/assign.js b/client/src/views/stream/notes/assign.js
index 147605bad..649dbacf4 100644
--- a/client/src/views/stream/notes/assign.js
+++ b/client/src/views/stream/notes/assign.js
@@ -50,11 +50,11 @@ Espo.define('views/stream/notes/assign', 'views/stream/note', function (Dep) {
             var data = this.model.get('data');
 
             this.assignedUserId = data.assignedUserId || null;
             this.assignedUserName = data.assignedUserName || null;
 
-            this.messageData['assignee'] = '<a href="#User/view/' + data.assignedUserId + '">' + data.assignedUserName + '</a>';
+            this.messageData['assignee'] = '<a href="#User/view/' + this.getHelper().escapeString(data.assignedUserId) + '">' + this.getHelper().escapeString(data.assignedUserName) + '</a>';
 
             if (this.isUserStream) {
                 if (this.assignedUserId) {
                     if (this.assignedUserId == this.model.get('createdById')) {
                         this.messageName += 'Self';
diff --git a/client/src/views/stream/notes/create-related.js b/client/src/views/stream/notes/create-related.js
index b269f4eed..1d6ab2ba4 100644
--- a/client/src/views/stream/notes/create-related.js
+++ b/client/src/views/stream/notes/create-related.js
@@ -54,11 +54,11 @@ Espo.define('views/stream/notes/create-related', 'views/stream/note', function (
             this.entityType = this.model.get('relatedType') || data.entityType || null;
             this.entityId = this.model.get('relatedId') || data.entityId || null;
             this.entityName = this.model.get('relatedName') ||  data.entityName || null;
 
             this.messageData['relatedEntityType'] = this.translateEntityType(this.entityType);
-            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
+            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
 
             this.createMessage();
         }
     });
 });
diff --git a/client/src/views/stream/notes/create.js b/client/src/views/stream/notes/create.js
index cda35873a..60c2021a5 100644
--- a/client/src/views/stream/notes/create.js
+++ b/client/src/views/stream/notes/create.js
@@ -50,11 +50,11 @@ Espo.define('views/stream/notes/create', 'views/stream/note', function (Dep) {
                 var data = this.model.get('data');
 
                 this.assignedUserId = data.assignedUserId || null;
                 this.assignedUserName = data.assignedUserName || null;
 
-                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.assignedUserName + '</a>';
+                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.getHelper().escapeString(this.assignedUserName) + '</a>';
 
                 var isYou = false;
                 if (this.isUserStream) {
                     if (this.assignedUserId == this.getUser().id) {
                         isYou = true;
diff --git a/client/src/views/stream/notes/email-received.js b/client/src/views/stream/notes/email-received.js
index 198701808..5cbd5d5b3 100644
--- a/client/src/views/stream/notes/email-received.js
+++ b/client/src/views/stream/notes/email-received.js
@@ -65,21 +65,21 @@ Espo.define('views/stream/notes/email-received', 'views/stream/note', function (
                     this.createField('attachments', 'attachmentMultiple', {}, 'views/stream/fields/attachment-multiple');
                     this.hasAttachments = true;
                 }
             }
 
-            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
+            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
 
             this.messageName = 'emailReceived';
 
             if (data.isInitial) {
                 this.messageName += 'Initial';
             }
 
             if (data.personEntityId) {
                 this.messageName += 'From';
-                this.messageData['from'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+                this.messageData['from'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
             }
 
             if (this.model.get('parentType') === data.personEntityType && this.model.get('parentId') == data.personEntityId) {
                 this.isThis = true;
             }
diff --git a/client/src/views/stream/notes/email-sent.js b/client/src/views/stream/notes/email-sent.js
index c033fee55..fb56a0b63 100644
--- a/client/src/views/stream/notes/email-sent.js
+++ b/client/src/views/stream/notes/email-sent.js
@@ -63,15 +63,15 @@ Espo.define('views/stream/notes/email-sent', 'views/stream/note', function (Dep)
                     this.createField('attachments', 'attachmentMultiple', {}, 'views/stream/fields/attachment-multiple');
                     this.hasAttachments = true;
                 }
             }
 
-            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
+            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
 
             this.messageName = 'emailSent';
 
-            this.messageData['by'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
+            this.messageData['by'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
 
 
             if (this.isThis) {
                 this.messageName += 'This';
             }
diff --git a/client/src/views/stream/notes/mention-in-post.js b/client/src/views/stream/notes/mention-in-post.js
index 2ea90e797..80d98cf55 100644
--- a/client/src/views/stream/notes/mention-in-post.js
+++ b/client/src/views/stream/notes/mention-in-post.js
@@ -74,11 +74,11 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
                                 var targetHtml = '';
                                 var teamHtmlList = [];
                                 teamIdList.forEach(function (teamId) {
                                     var teamName = teamNameHash[teamId];
                                     if (teamName) {
-                                        teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
+                                        teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                                     }
                                 }, this);
 
                                 this.messageData['target'] = teamHtmlList.join(', ');
                             } else if (this.model.has('usersIds') && this.model.get('usersIds').length) {
@@ -91,11 +91,11 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
                                     var userHtml = '';
                                     var userHtmlList = [];
                                     userIdList.forEach(function (userId) {
                                         var userName = userNameHash[userId];
                                         if (userName) {
-                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');
+                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
                                         }
                                     }, this);
                                     this.messageData['target'] = userHtmlList.join(', ');
                                 }
                             } else if (this.model.get('targetType') === 'self') {
@@ -111,6 +111,5 @@ Espo.define('views/stream/notes/mention-in-post', 'views/stream/note', function
             this.createMessage();
         }
 
     });
 });
-
diff --git a/client/src/views/stream/notes/post.js b/client/src/views/stream/notes/post.js
index 96c6a6c74..a50af61e3 100644
--- a/client/src/views/stream/notes/post.js
+++ b/client/src/views/stream/notes/post.js
@@ -83,11 +83,11 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                         var targetHtml = '';
                         var teamHtmlList = [];
                         teamIdList.forEach(function (teamId) {
                             var teamName = teamNameHash[teamId];
                             if (teamName) {
-                                teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
+                                teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                             }
                         }, this);
 
                         this.messageData['target'] = teamHtmlList.join(', ');
                     } else if (this.model.has('portalsIds') && this.model.get('portalsIds').length) {
@@ -101,11 +101,11 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                         var targetHtml = '';
                         var portalHtmlList = [];
                         portalIdList.forEach(function (portalId) {
                             var portalName = portalNameHash[portalId];
                             if (portalName) {
-                                portalHtmlList.push('<a href="#Portal/view/' + portalId + '">' + portalName + '</a>');
+                                portalHtmlList.push('<a href="#Portal/view/' + this.getHelper().escapeString(portalId) + '">' + this.getHelper().escapeString(portalName) + '</a>');
                             }
                         }, this);
 
                         this.messageData['target'] = portalHtmlList.join(', ');
                     } else if (this.model.has('usersIds') && this.model.get('usersIds').length) {
@@ -133,11 +133,11 @@ Espo.define('views/stream/notes/post', 'views/stream/note', function (Dep) {
                                     if (userId === this.model.get('createdById')) {
                                         this.messageName = 'postTargetSelfAndOthers';
                                     } else {
                                         var userName = userNameHash[userId];
                                         if (userName) {
-                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');
+                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
                                         }
                                     }
                                 }
                             }, this);
                             this.messageData['target'] = userHtmlList.join(', ');
diff --git a/client/src/views/stream/notes/relate.js b/client/src/views/stream/notes/relate.js
index 261a8eb96..0ae91a419 100644
--- a/client/src/views/stream/notes/relate.js
+++ b/client/src/views/stream/notes/relate.js
@@ -53,11 +53,11 @@ Espo.define('views/stream/notes/relate', 'views/stream/note', function (Dep) {
             this.entityType = this.model.get('relatedType') || data.entityType || null;
             this.entityId = this.model.get('relatedId') || data.entityId || null;
             this.entityName = this.model.get('relatedName') ||  data.entityName || null;
 
             this.messageData['relatedEntityType'] = this.translateEntityType(this.entityType);
-            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
+            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
 
             this.createMessage();
         },
     });
 });
diff --git a/client/src/views/stream/notes/status.js b/client/src/views/stream/notes/status.js
index 571eb4038..4723ede35 100644
--- a/client/src/views/stream/notes/status.js
+++ b/client/src/views/stream/notes/status.js
@@ -54,11 +54,11 @@ Espo.define('views/stream/notes/status', 'views/stream/note', function (Dep) {
             var field = data.field;
             var value = data.value;
 
             this.style = data.style || 'default';
 
-            this.statusText = this.getLanguage().translateOption(value, field, this.model.get('parentType'));
+            this.statusText = this.getHelper().escapeString(this.getLanguage().translateOption(value, field, this.model.get('parentType')));
 
             this.messageData['field'] = this.translate(field, 'fields', this.model.get('parentType')).toLowerCase();
 
             this.createMessage();
         },

Vulnerable code:             var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
            this.messageData['entity'] = '<a href="#' + data.entityType + '/view/' + data.entityId + '">' + data.entityName + '</a>';
            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
                this.messageData['from'] = '<a href="#' + data.personEntityType + '/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
                this.messageData['from'] = data.fromString || this.translate('empty address');
            this.emailId = data.emailId;
            this.emailName = data.emailName;

            this.messageData['entityType'] = (this.translate(data.entityType, 'scopeNames') || '').toLowerCase();
            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
            this.messageData['entityType'] = Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
            this.messageData['user'] = '<a href="#User/view/' + data.userId + '">' + data.userName + '</a>';
            this.messageData['entity'] = '<a href="#'+data.entityType+'/view/' + data.entityId + '">' + data.entityName + '</a>';
                userName: this.getUser().get('name'),
                    html: avatarHtml + this.getUser().get('name')
                'entityType': this.translateEntityType(this.model.get('parentType')),
            this.messageData['assignee'] = '<a href="#User/view/' + data.assignedUserId + '">' + data.assignedUserName + '</a>';
            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.assignedUserName + '</a>';
            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
                this.messageData['from'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
            this.messageData['email'] = '<a href="#Email/view/' + data.emailId + '">' + data.emailName + '</a>';
            this.messageData['by'] = '<a href="#'+data.personEntityType+'/view/' + data.personEntityId + '">' + data.personEntityName + '</a>';
                                        teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');

                                teamHtmlList.push('<a href="#Team/view/' + teamId + '">' + teamName + '</a>');
                                portalHtmlList.push('<a href="#Portal/view/' + portalId + '">' + portalName + '</a>');
                                            userHtmlList.push('<a href="#User/view/' + userId + '">' + userName + '</a>');
            this.messageData['relatedEntity'] = '<a href="#' + this.entityType + '/view/' + this.entityId + '">' + this.entityName +'</a>';
            this.statusText = this.getLanguage().translateOption(value, field, this.model.get('parentType'));
Fixed code:             if (name) {
                name = this.getHelper().escapeString(name);
            }

            if (name) {
                name = this.getHelper().escapeString(name);
            }
            if (address) {
                name = this.getHelper().escapeString(address);
            }

            if (name) {
                name = this.getHelper().escapeString(name);
            }


            if (name) {
                name = this.getHelper().escapeString(name);
            }

            address = this.getHelper().escapeString(address);

            if (name) {
                name = this.getHelper().escapeString(name);
            }

            if (name) {
                name = this.getHelper().escapeString(name);
            }

            var nameHtml = '<div>' + this.getHelper().escapeString(name) + '&nbsp;' + '</div>';
            this.messageData['entity'] = '<a href="#' + this.getHelper().escapeString(data.entityType) + '/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
                this.messageData['from'] = '<a href="#' + this.getHelper().escapeString(data.personEntityType) + '/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
                this.messageData['from'] = this.getHelper().escapeString(data.fromString || this.translate('empty address'));
            this.emailId = this.getHelper().escapeString(data.emailId);
            this.emailName = this.getHelper().escapeString(data.emailName);
            this.messageData['entityType'] = this.getHelper().escapeString((this.translate(data.entityType, 'scopeNames') || '').toLowerCase());
            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
            this.messageData['user'] = '<a href="#User/view/' + this.getHelper().escapeString(data.userId) + '">' + this.getHelper().escapeString(data.userName) + '</a>';
            this.messageData['entity'] = '<a href="#'+this.getHelper().escapeString(data.entityType)+'/view/' + this.getHelper().escapeString(data.entityId) + '">' + this.getHelper().escapeString(data.entityName) + '</a>';
                    html: avatarHtml + this.getHelper().escapeString(this.getUser().get('name')),
                'entityType': this.getHelper().escapeString(this.translateEntityType(this.model.get('parentType'))),
            this.messageData['assignee'] = '<a href="#User/view/' + this.getHelper().escapeString(data.assignedUserId) + '">' + this.getHelper().escapeString(data.assignedUserName) + '</a>';
            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
                this.messageData['assignee'] = '<a href="#User/view/' + this.assignedUserId + '">' + this.getHelper().escapeString(this.assignedUserName) + '</a>';
            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
                this.messageData['from'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
            this.messageData['email'] = '<a href="#Email/view/' + this.getHelper().escapeString(data.emailId) + '">' + this.getHelper().escapeString(data.emailName) + '</a>';
            this.messageData['by'] = '<a href="#'+this.getHelper().escapeString(data.personEntityType)+'/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
                                        teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
                                teamHtmlList.push('<a href="#Team/view/' + this.getHelper().escapeString(teamId) + '">' + this.getHelper().escapeString(teamName) + '</a>');
                                portalHtmlList.push('<a href="#Portal/view/' + this.getHelper().escapeString(portalId) + '">' + this.getHelper().escapeString(portalName) + '</a>');
                                            userHtmlList.push('<a href="#User/view/' + this.getHelper().escapeString(userId) + '">' + this.getHelper().escapeString(userName) + '</a>');
            this.messageData['relatedEntity'] = '<a href="#' + this.getHelper().escapeString(this.entityType) + '/view/' + this.getHelper().escapeString(this.entityId) + '">' + this.getHelper().escapeString(this.entityName) +'</a>';
            this.statusText = this.getHelper().escapeString(this.getLanguage().translateOption(value, field, this.model.get('parentType')));