CVE-2022-1571: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-04T11:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/Model/Subcuenta.php
Commit date: 2022-05-03 20:23:16 +0200
Commit message: Escaped html code from model fields to improve security.
------
Escapado el html de los campos del modelo para mejorar la seguridad.

Diff: diff --git a/Core/Model/Subcuenta.php b/Core/Model/Subcuenta.php
index 21a9e05f0..c1eefe33f 100644
--- a/Core/Model/Subcuenta.php
+++ b/Core/Model/Subcuenta.php
@@ -203,12 +203,16 @@ class Subcuenta extends Base\ModelClass
 
     public function test(): bool
     {
         $this->saldo = $this->debe - $this->haber;
 
-        $this->codcuenta = trim($this->codcuenta);
-        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : trim($this->codsubcuenta);
+        // escape html
+        foreach (['codcuenta', 'codsubcuenta', 'descripcion', 'codcuentaesp'] as $field) {
+            $this->{$field} = self::toolBox()::utils()::noHtml($this->{$field});
+        }
+
+        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : $this->codsubcuenta;
         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
         if (strlen($this->descripcion) < 1 || strlen($this->descripcion) > 255) {
             $this->toolBox()->i18nLog()->warning(
                 'invalid-column-lenght',
                 ['%column%' => 'descripcion', '%min%' => '1', '%max%' => '255']
@@ -216,11 +220,11 @@ class Subcuenta extends Base\ModelClass
             return false;
         }
 
         // check exercise
         $exercise = $this->getExercise();
-        if (!$this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
+        if (false === $this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
             $this->toolBox()->i18nLog()->warning('account-length-error', ['%code%' => $this->codsubcuenta]);
             return false;
         }
 
         // sets account data

Vulnerable code:         $this->codcuenta = trim($this->codcuenta);
        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : trim($this->codsubcuenta);
        if (!$this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
Fixed code:         // escape html
        foreach (['codcuenta', 'codsubcuenta', 'descripcion', 'codcuentaesp'] as $field) {
            $this->{$field} = self::toolBox()::utils()::noHtml($this->{$field});
        }

        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : $this->codsubcuenta;
        if (false === $this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {