CVE-2022-4929: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is able to address this issue. The patch is identified as fa785969f213c76384f1fe67d47b17d57fcc60c8. It is recommended to upgrade the affected component. VDB-222290 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-06T03:15Z
Repository: https://github.com/icplayer/icplayer
Language: JavaScript
Files changed: addons/Commons/src/tts-utils.js, addons/Table/src/presenter.js, changelog.txt
Commit date: 2022-12-09 10:21:34 +0100
Commit message: fix(addons): Fix XSS vulnerabilities in Table and tts-utils (#885)

* sanitize Wiris response against XSS in the Wiris addon

* added tests

* fix(addons): Fix XSS vulnerabilities in Table addon and tts-utils

Co-authored-by: Maciej Zawłocki <mzawlocki@solwit.com>
Co-authored-by: maciej-zawlocki-solwit <34648176+maciej-zawlocki-solwit@users.noreply.github.com>
Diff: diff --git a/addons/Commons/src/tts-utils.js b/addons/Commons/src/tts-utils.js
index 746d8da1..d7ef1fc9 100644
--- a/addons/Commons/src/tts-utils.js
+++ b/addons/Commons/src/tts-utils.js
@@ -194,11 +194,11 @@
 
         _prepareImages: function($clone) {
             var breakText = this.statics.breakText;
 
             $clone.find('img[alt]').each(function(){
-                var altText = $(this).attr('alt');
+                var altText = window.xssUtils.sanitize($(this).attr('alt'));
                 $('<span>' + breakText + '</span>').insertBefore($(this));
                 $('<span>' + breakText + '</span>').insertAfter($(this));
                 $('<span>' + altText + '</span>').insertAfter($(this));
             });
 
diff --git a/addons/Table/src/presenter.js b/addons/Table/src/presenter.js
index 1cb17b40..4ba361ec 100644
--- a/addons/Table/src/presenter.js
+++ b/addons/Table/src/presenter.js
@@ -131,11 +131,11 @@ function AddonTable_create() {
         if (presenter.hasMathGaps()){
             presenter.gapsContainer.gaps = [];
             $(presenter.$view).find('input').each(function () {
                 $(this).replaceWith(
                     generateMathGap(
-                        $(this).attr('id'),
+                        window.xssUtils.sanitize($(this).attr('id')),
                         presenter.configuration.gapWidth.value
                     )
                 );
             });
         }
diff --git a/changelog.txt b/changelog.txt
index e7d8544d..0617ea91 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,5 +1,6 @@
+2022-12-09 Fixed XSS vulnerabilities in Table and tts-utils
 2022-12-09 Fixed XSS vulnerabilities in some addons
 2022-12-08 Fixed script and module-script asset getting relative urls when not appropriate
 2022-11-28 Added ModuleScript property
 2022-11-25 Removed pause while reading syntax about time for TTS
 2022-11-25 Fixed TTS reading an extra comma when alt text with dot is present at the end of a list element  

Vulnerable code:                 var altText = $(this).attr('alt');
                        $(this).attr('id'),
Fixed code:                 var altText = window.xssUtils.sanitize($(this).attr('alt'));
                        window.xssUtils.sanitize($(this).attr('id')),
2022-12-09 Fixed XSS vulnerabilities in Table and tts-utils