CVE-2023-0488: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-26T22:15Z
Repository: https://github.com/pyload/pyload
Language: JavaScript
Files changed: src/pyload/webui/app/themes/modern/static/css/base.css, src/pyload/webui/app/themes/modern/templates/js/packages.js, src/pyload/webui/app/themes/pyplex/templates/js/packages.js
Commit date: 2023-01-25 01:53:04 +0200
Commit message: make queue/collector links unclickable to prevent XSS

Diff: diff --git a/src/pyload/webui/app/themes/modern/static/css/base.css b/src/pyload/webui/app/themes/modern/static/css/base.css
index 476f7bc306..909836935e 100644
--- a/src/pyload/webui/app/themes/modern/static/css/base.css
+++ b/src/pyload/webui/app/themes/modern/static/css/base.css
@@ -287,9 +287,5 @@ fieldset[disabled] .btn {
 }
 
 .modal-dialog {
     margin-top: 10px;
 }
-
-.modal-dialog {
-    margin-top: 10px;
-}
diff --git a/src/pyload/webui/app/themes/modern/templates/js/packages.js b/src/pyload/webui/app/themes/modern/templates/js/packages.js
index 71518c809d..d6afae4539 100644
--- a/src/pyload/webui/app/themes/modern/templates/js/packages.js
+++ b/src/pyload/webui/app/themes/modern/templates/js/packages.js
@@ -174,11 +174,11 @@ function Package (ui, id, ele){
                 link.icon = 'glyphicon glyphicon-cog';
             else
                 link.icon = 'glyphicon glyphicon-cloud-download';
 
             var html = "<span class='child_status'><span style='margin-right: 2px;color: #337ab7;' class='" + link.icon + "'></span></span>\n" +
-                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
+                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                        "<div class='child_secrow' style='margin-left: 21px; margin-bottom: 7px; border-radius: 4px;'>" +
                        "<span class='child_status' style='font-size: 12px; color:#555; padding-left: 5px;'>" + link.statusmsg + "</span>&nbsp;" + link.error + "&nbsp;" +
                        "<span class='child_status' style='font-size: 12px; color:#555;'>" + link.format_size + "</span>" +
                        "<span class='child_status' style='font-size: 12px; color:#555;'> " + link.plugin + "</span>&nbsp;&nbsp;" +
                        "<span class='glyphicon glyphicon-trash' title='{{_('Delete Link')}}' style='cursor: pointer;  font-size: 12px; color:#333;' ></span>&nbsp;&nbsp;" +
diff --git a/src/pyload/webui/app/themes/pyplex/templates/js/packages.js b/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
index 6b04580aa7..c7b73ee01b 100644
--- a/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
+++ b/src/pyload/webui/app/themes/pyplex/templates/js/packages.js
@@ -174,11 +174,11 @@ function Package (ui, id, ele){
                 link.icon = 'glyphicon glyphicon-cog';
             else
                 link.icon = 'glyphicon glyphicon-cloud-download';
 
             var html = "<span class='child_status'><span style='margin-right: 2px;color: #f9be03;' class='" + link.icon + "'></span></span>\n" +
-                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
+                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                        "<div class='child_secrow' style='margin-left: 21px; margin-bottom: 7px; border-radius: 4px;'>" +
                        "<span class='child_status' style='font-size: 12px; color:#eee; padding-left: 5px;'>" + link.statusmsg + "</span>&nbsp;" + link.error + "&nbsp;" +
                        "<span class='child_status' style='font-size: 12px; color:#eee;'>" + link.format_size + "</span>" +
                        "<span class='child_status' style='font-size: 12px; color:#eee;'> " + link.plugin + "</span>&nbsp;&nbsp;" +
                        "<span class='glyphicon glyphicon-trash' title='{{_('Delete Link')}}' style='cursor: pointer;  font-size: 12px; color:#eee;' ></span>&nbsp;&nbsp;" +

Vulnerable code: 
.modal-dialog {
    margin-top: 10px;
}
                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
Fixed code:                        "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +