CVE-2022-0928: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-11T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/api_callbacks.php, src/MicroweberPackages/Tax/TaxManager.php, src/MicroweberPackages/Tax/TaxManagerServiceProvider.php, src/MicroweberPackages/Tax/routes/api.php, src/MicroweberPackages/Tax/routes/web.php
Commit date: 2022-03-11 12:20:31 +0200
Commit message: upgrade taxes to laravel routers

Diff: diff --git a/src/MicroweberPackages/App/functions/api_callbacks.php b/src/MicroweberPackages/App/functions/api_callbacks.php
index 0ed078b2cb8d..32c25dd2f5ee 100644
--- a/src/MicroweberPackages/App/functions/api_callbacks.php
+++ b/src/MicroweberPackages/App/functions/api_callbacks.php
@@ -139,16 +139,10 @@ api_expose_admin('update_order');
 
 api_expose_admin('shop/update_order', function ($data) {
     return mw()->shop_manager->update_order($data);
 });
 
-api_expose_admin('shop/save_tax_item', function ($data) {
-    return mw()->tax_manager->save($data);
-});
-api_expose_admin('shop/delete_tax_item', function ($data) {
-    return mw()->tax_manager->delete_by_id($data);
-});
 
 api_expose_admin('shop/export_orders', function ($data) {
     return mw()->order_manager->export_orders($data);
 });
 
diff --git a/src/MicroweberPackages/Tax/TaxManager.php b/src/MicroweberPackages/Tax/TaxManager.php
index 6e7f4d4897f2..da29f08dbadf 100644
--- a/src/MicroweberPackages/Tax/TaxManager.php
+++ b/src/MicroweberPackages/Tax/TaxManager.php
@@ -9,10 +9,13 @@
  *
  */
 
 namespace MicroweberPackages\Tax;
 
+use Illuminate\Support\Facades\Validator;
+use MicroweberPackages\Helper\HTMLClean;
+
 class TaxManager
 {
     /** @var \MicroweberPackages\App\LaravelApplication */
     public $app;
 
@@ -48,10 +51,22 @@ class TaxManager
     {
         if (isset($params['rate'])) {
             $params['rate'] = floatval($params['rate']);
         }
 
+        $rules = [];
+        $rules['name'] = 'required|max:500';
+        $rules['type'] = 'required|max:500';
+        $rules['rate'] = 'required|max:500';
+
+        $validator = Validator::make($params, $rules);
+
+        if ($validator->fails()) {
+            $errors = $validator->messages()->toArray();
+            return ['valid'=>false,'errors'=>$errors];
+        }
+
         $taxType = TaxType::where('id', $params['id'])->first();
         if (!$taxType) {
             $taxType = new TaxType();
         }
 
diff --git a/src/MicroweberPackages/Tax/TaxManagerServiceProvider.php b/src/MicroweberPackages/Tax/TaxManagerServiceProvider.php
index 3c5d75e7fb87..0693a9e3e875 100644
--- a/src/MicroweberPackages/Tax/TaxManagerServiceProvider.php
+++ b/src/MicroweberPackages/Tax/TaxManagerServiceProvider.php
@@ -30,6 +30,12 @@ class TaxManagerServiceProvider extends ServiceProvider
             return new TaxManager();
         });
 
         $this->loadMigrationsFrom(__DIR__ . '/database/migrations/');
     }
+
+    public function register()
+    {
+        $this->loadRoutesFrom((__DIR__) . '/routes/api.php');
+        $this->loadRoutesFrom((__DIR__) . '/routes/web.php');
+    }
 }
diff --git a/src/MicroweberPackages/Tax/routes/api.php b/src/MicroweberPackages/Tax/routes/api.php
new file mode 100644
index 000000000000..91437fc37854
--- /dev/null
+++ b/src/MicroweberPackages/Tax/routes/api.php
@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Support\Facades\Route;
+
+\Route::name('api.')
+
+    ->prefix('api')
+    ->middleware(['api', 'admin', 'xss'])
+    ->namespace('\MicroweberPackages\Tax\Http\Controllers\Api')
+    ->group(function () {
+
+        Route::any('shop/save_tax_item', function () {
+            $data = request()->all();
+            return mw()->tax_manager->save($data);
+        });
+
+        Route::any('shop/delete_tax_item', function () {
+            $data = request()->all();
+            return mw()->tax_manager->delete_by_id($data);
+        });
+
+    });
diff --git a/src/MicroweberPackages/Tax/routes/web.php b/src/MicroweberPackages/Tax/routes/web.php
new file mode 100644
index 000000000000..b3d9bbc7f371
--- /dev/null
+++ b/src/MicroweberPackages/Tax/routes/web.php
@@ -0,0 +1 @@
+<?php

Vulnerable code: api_expose_admin('shop/save_tax_item', function ($data) {
    return mw()->tax_manager->save($data);
});
api_expose_admin('shop/delete_tax_item', function ($data) {
    return mw()->tax_manager->delete_by_id($data);
});
Fixed code: use Illuminate\Support\Facades\Validator;
use MicroweberPackages\Helper\HTMLClean;

        $rules = [];
        $rules['name'] = 'required|max:500';
        $rules['type'] = 'required|max:500';
        $rules['rate'] = 'required|max:500';

        $validator = Validator::make($params, $rules);

        if ($validator->fails()) {
            $errors = $validator->messages()->toArray();
            return ['valid'=>false,'errors'=>$errors];
        }


    public function register()
    {
        $this->loadRoutesFrom((__DIR__) . '/routes/api.php');
        $this->loadRoutesFrom((__DIR__) . '/routes/web.php');
    }
<?php

use Illuminate\Support\Facades\Route;

\Route::name('api.')

    ->prefix('api')
    ->middleware(['api', 'admin', 'xss'])
    ->namespace('\MicroweberPackages\Tax\Http\Controllers\Api')
    ->group(function () {

        Route::any('shop/save_tax_item', function () {
            $data = request()->all();
            return mw()->tax_manager->save($data);
        });

        Route::any('shop/delete_tax_item', function () {
            $data = request()->all();
            return mw()->tax_manager->delete_by_id($data);
        });

    });
<?php