CVE-2022-1988: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-03T08:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/Model/Cuenta.php, Core/Translation/gl_ES.json, Test/Core/Model/CuentaTest.php
Commit date: 2022-05-31 12:53:15 +0200
Commit message: - Añadida comprobación de html en descripción al test unitario del modelo cuenta.
- Eliminado el test unitario de subcuenta por obsoleto. Se creará uno nuevo a continuación.

Diff: diff --git a/Core/Model/Cuenta.php b/Core/Model/Cuenta.php
index eced8f24a6..ad0116e150 100644
--- a/Core/Model/Cuenta.php
+++ b/Core/Model/Cuenta.php
@@ -183,16 +183,17 @@ class Cuenta extends Base\ModelClass
     }
 
     public function test(): bool
     {
         $this->codcuenta = trim($this->codcuenta);
+        $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
+
         if (empty($this->codcuenta) || false === is_numeric($this->codcuenta)) {
             $this->toolBox()->i18nLog()->warning('invalid-number', ['%number%' => $this->codcuenta]);
             return false;
         }
 
-        $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
         if (strlen($this->descripcion) < 1 || strlen($this->descripcion) > 255) {
             $this->toolBox()->i18nLog()->warning('invalid-column-lenght', ['%column%' => 'descripcion', '%min%' => '1', '%max%' => '255']);
             return false;
         }
 
diff --git a/Core/Translation/gl_ES.json b/Core/Translation/gl_ES.json
index 3ee2436704..60c0b78bba 100644
--- a/Core/Translation/gl_ES.json
+++ b/Core/Translation/gl_ES.json
@@ -419,11 +419,11 @@
     "email-signature": "Sinatura do email",
     "email-to": "Correo para",
     "emails-sent": "Emails enviados",
     "employees": "Empregados",
     "empty": "Vacío",
-    "empty-contact-data": "El contacto debe tener nombre o email o dirección",
+    "empty-contact-data": "O contacto debe ter nome ou email ou dirección",
     "enable": "Activar",
     "enable-api": "Activar API",
     "enable-updates-beta": "Activar actualizacións beta",
     "enabled": "Activo",
     "encrypt": "Encriptación",
diff --git a/Test/Core/Model/CuentaTest.php b/Test/Core/Model/CuentaTest.php
index 2c35c734c9..4cf4301e99 100644
--- a/Test/Core/Model/CuentaTest.php
+++ b/Test/Core/Model/CuentaTest.php
@@ -70,10 +70,25 @@ final class CuentaTest extends TestCase
         if ($save) {
             $account->delete();
         }
     }
 
+    public function testHtmlOnDescription()
+    {
+        $account = new Cuenta();
+        $account->codcuenta = '9999';
+        $account->codejercicio = $this->getRandomExercise()->codejercicio;
+        $account->descripcion = '<b>Test</b>';
+        $this->assertTrue($account->save(), 'can-not-create-account');
+
+        // comprobamos que el html se ha escapado
+        $this->assertEquals('&lt;b&gt;Test&lt;/b&gt;', $account->descripcion);
+
+        // eliminamos
+        $this->assertTrue($account->delete(), 'account-cant-delete');
+    }
+
     public function testCreateClosed()
     {
         // cerramos un ejercicio
         $exercise = $this->getRandomExercise();
         $exercise->estado = Ejercicio::EXERCISE_STATUS_CLOSED;
diff --git a/Test/Core/Model/SubcuentaTest.php b/Test/Core/Model/SubcuentaTest.php
deleted file mode 100644
index f7e3d614e9..0000000000
--- a/Test/Core/Model/SubcuentaTest.php
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php
-/**
- * This file is part of FacturaScripts
- * Copyright (C) 2017       Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
- * Copyright (C) 2017-2018  Carlos Garcia Gomez     <carlos@facturascripts.com>
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- */
-
-namespace FacturaScripts\Test\Core\Model;
-
-use FacturaScripts\Core\Model\Subcuenta;
-use FacturaScripts\Test\Core\CustomTest;
-
-/**
- * @covers \Subcuenta
- *
- * @author Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
- */
-final class SubcuentaTest extends CustomTest
-{
-
-    protected function setUp(): void
-    {
-        $this->model = new Subcuenta();
-    }
-}

Vulnerable code:         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
    "empty-contact-data": "El contacto debe tener nombre o email o dirección",
<?php
/**
 * This file is part of FacturaScripts
 * Copyright (C) 2017       Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
 * Copyright (C) 2017-2018  Carlos Garcia Gomez     <carlos@facturascripts.com>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

namespace FacturaScripts\Test\Core\Model;

use FacturaScripts\Core\Model\Subcuenta;
use FacturaScripts\Test\Core\CustomTest;

/**
 * @covers \Subcuenta
 *
 * @author Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
 */
final class SubcuentaTest extends CustomTest
{

    protected function setUp(): void
    {
        $this->model = new Subcuenta();
    }
}
Fixed code:         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);

    "empty-contact-data": "O contacto debe ter nome ou email ou dirección",
    public function testHtmlOnDescription()
    {
        $account = new Cuenta();
        $account->codcuenta = '9999';
        $account->codejercicio = $this->getRandomExercise()->codejercicio;
        $account->descripcion = '<b>Test</b>';
        $this->assertTrue($account->save(), 'can-not-create-account');

        // comprobamos que el html se ha escapado
        $this->assertEquals('&lt;b&gt;Test&lt;/b&gt;', $account->descripcion);

        // eliminamos
        $this->assertTrue($account->delete(), 'account-cant-delete');
    }