CVE-2022-0954: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T12:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
Commit date: 2022-03-14 12:14:14 +0200
Commit message: Update SaveOptionApiController.php

Diff: diff --git a/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php b/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
index 33c8fa4c5b22..e40d5b03a831 100644
--- a/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
+++ b/src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
@@ -4,22 +4,34 @@ namespace MicroweberPackages\Option\Http\Controllers\Api;
 
 use Illuminate\Http\Request;
 
 class SaveOptionApiController
 {
-    public function saveOption(Request $request) {
+    public $whitelistedGroupKeys = [
+        'website' => [
+            'website_head',
+            'website_footer'
+        ]
+    ];
+
+    public function saveOption(Request $request)
+    {
 
         $cleanFromXss = true;
         $option = $request->all();
 
-        // Allow for this keys
+        // Allow for this keys and groups
         if (isset($option['option_key'])) {
-            if ($option['option_key'] == 'website_head') {
-                $cleanFromXss = false;
-            }
-            if ($option['option_key'] == 'website_footer') {
-                $cleanFromXss = false;
+            foreach ($this->whitelistedGroupKeys as $group => $keys) {
+                if ($option['option_group'] == $group) {
+                    foreach ($keys as $key) {
+                        if ($option['option_key'] == $key) {
+                            $cleanFromXss = false;
+                            break;
+                        }
+                    }
+                }
             }
         }
 
         if ($cleanFromXss) {
             $clean = new HTMLClean();

Vulnerable code:     public function saveOption(Request $request) {
        // Allow for this keys
            if ($option['option_key'] == 'website_head') {
                $cleanFromXss = false;
            }
            if ($option['option_key'] == 'website_footer') {
                $cleanFromXss = false;
Fixed code:     public $whitelistedGroupKeys = [
        'website' => [
            'website_head',
            'website_footer'
        ]
    ];

    public function saveOption(Request $request)
    {
        // Allow for this keys and groups
            foreach ($this->whitelistedGroupKeys as $group => $keys) {
                if ($option['option_group'] == $group) {
                    foreach ($keys as $key) {
                        if ($option['option_key'] == $key) {
                            $cleanFromXss = false;
                            break;
                        }
                    }
                }