CVE-2021-4284: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 811990972ea07649ae33c4b56c61c3b520895f07. It is recommended to upgrade the affected component. The identifier VDB-216873 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T10:15Z
Repository: https://github.com/openmrs/openmrs-module-htmlformentryui
Language: Other
Files changed: api/src/main/java/org/openmrs/module/htmlformentryui/HtmlFormUtil.java, omod/src/main/java/org/openmrs/module/htmlformentryui/fragment/controller/htmlform/EnterHtmlFormFragmentController.java, omod/src/main/java/org/openmrs/module/htmlformentryui/page/controller/htmlform/ViewEncounterWithHtmlFormPageController.java, omod/src/main/webapp/pages/htmlform/editHtmlFormWithSimpleUi.gsp, omod/src/main/webapp/pages/htmlform/editHtmlFormWithStandardUi.gsp, omod/src/main/webapp/pages/htmlform/enterHtmlFormWithSimpleUi.gsp, omod/src/main/webapp/pages/htmlform/enterHtmlFormWithStandardUi.gsp, omod/src/main/webapp/pages/htmlform/viewEncounterWithHtmlForm.gsp
Commit date: 2021-07-05 10:19:48 -0500
Commit message: Ra 1424:  escapeJs is vulnerable to XSS attacks  (#51)

* RA-1424: escapeJs vulnerable to XSS

* RA-1424: escapeJs vulnerable to XSS
Diff: diff --git a/api/src/main/java/org/openmrs/module/htmlformentryui/HtmlFormUtil.java b/api/src/main/java/org/openmrs/module/htmlformentryui/HtmlFormUtil.java
index c2b267e..bdc6067 100644
--- a/api/src/main/java/org/openmrs/module/htmlformentryui/HtmlFormUtil.java
+++ b/api/src/main/java/org/openmrs/module/htmlformentryui/HtmlFormUtil.java
@@ -201,11 +201,11 @@ public class HtmlFormUtil {
 	public static String determineReturnLabel(String returnLabel, Patient patient, UiUtils ui) {
 		
 		if (org.apache.commons.lang.StringUtils.isNotBlank(returnLabel)) {
 			return ui.message(returnLabel);
 		} else {
-			return ui.escapeJs(ui.format(patient));
+			return ui.encodeJavaScript(ui.format(patient));
 		}
 		
 	}
 	
 	private static String trim(String s) {
diff --git a/omod/src/main/java/org/openmrs/module/htmlformentryui/fragment/controller/htmlform/EnterHtmlFormFragmentController.java b/omod/src/main/java/org/openmrs/module/htmlformentryui/fragment/controller/htmlform/EnterHtmlFormFragmentController.java
index cc0dd01..00c01f8 100644
--- a/omod/src/main/java/org/openmrs/module/htmlformentryui/fragment/controller/htmlform/EnterHtmlFormFragmentController.java
+++ b/omod/src/main/java/org/openmrs/module/htmlformentryui/fragment/controller/htmlform/EnterHtmlFormFragmentController.java
@@ -279,11 +279,11 @@ public class EnterHtmlFormFragmentController extends BaseHtmlFormFragmentControl
 		fes.applyActions();
 		
 		request.getSession().setAttribute(UiCommonsConstants.SESSION_ATTRIBUTE_INFO_MESSAGE,
 		    ui.message(
 		        editMode ? "htmlformentryui.editHtmlForm.successMessage" : "htmlformentryui.enterHtmlForm.successMessage",
-		        ui.format(hf.getForm()), ui.escapeJs(ui.format(patient))));
+		        ui.format(hf.getForm()), ui.encodeJavaScript(ui.format(patient))));
 		request.getSession().setAttribute(UiCommonsConstants.SESSION_ATTRIBUTE_TOAST_MESSAGE, "true");
 		
 		return returnHelper(null, fes, formEncounter);
 	}
 	
diff --git a/omod/src/main/java/org/openmrs/module/htmlformentryui/page/controller/htmlform/ViewEncounterWithHtmlFormPageController.java b/omod/src/main/java/org/openmrs/module/htmlformentryui/page/controller/htmlform/ViewEncounterWithHtmlFormPageController.java
index 68d191c..c315f5e 100644
--- a/omod/src/main/java/org/openmrs/module/htmlformentryui/page/controller/htmlform/ViewEncounterWithHtmlFormPageController.java
+++ b/omod/src/main/java/org/openmrs/module/htmlformentryui/page/controller/htmlform/ViewEncounterWithHtmlFormPageController.java
@@ -37,11 +37,11 @@ public class ViewEncounterWithHtmlFormPageController {
 		if (StringUtils.isEmpty(returnUrl)) {
 			returnUrl = ui.pageLink("coreapps", "patientdashboard/patientDashboard",
 			    SimpleObject.create("patientId", patient.getId()));
 		}
 		if (StringUtils.isEmpty(returnLabel)) {
-			returnLabel = ui.escapeJs(ui.format(patient.getPatient()));
+			returnLabel = ui.encodeJavaScript(ui.format(patient.getPatient()));
 		}
 		
 		model.addAttribute("patient", patient);
 		model.addAttribute("visit", encounter.getVisit());
 		model.addAttribute("encounter", encounter);
diff --git a/omod/src/main/webapp/pages/htmlform/editHtmlFormWithSimpleUi.gsp b/omod/src/main/webapp/pages/htmlform/editHtmlFormWithSimpleUi.gsp
index 9500590..3da8916 100644
--- a/omod/src/main/webapp/pages/htmlform/editHtmlFormWithSimpleUi.gsp
+++ b/omod/src/main/webapp/pages/htmlform/editHtmlFormWithSimpleUi.gsp
@@ -27,11 +27,11 @@ ${ ui.includeFragment("coreapps", "patientHeader", [ patient: patient ]) }
     var NavigatorController;
 
     var breadcrumbs = _.flatten([
         { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
         ${ breadcrumbMiddle },
-        { label: "${ ui.escapeJs(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
+        { label: "${ ui.encodeJavaScript(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
     ]);
 
     jQuery(function() {
         jq('input.submitButton').hide();
         jq('form#htmlform').append(jq('#confirmation-template').html());
diff --git a/omod/src/main/webapp/pages/htmlform/editHtmlFormWithStandardUi.gsp b/omod/src/main/webapp/pages/htmlform/editHtmlFormWithStandardUi.gsp
index b9dff06..a9bb45b 100644
--- a/omod/src/main/webapp/pages/htmlform/editHtmlFormWithStandardUi.gsp
+++ b/omod/src/main/webapp/pages/htmlform/editHtmlFormWithStandardUi.gsp
@@ -8,11 +8,11 @@
 
 <script type="text/javascript">
     var breadcrumbs = _.flatten([
         { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
         ${ breadcrumbMiddle },
-        { label: "${ ui.escapeJs(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
+        { label: "${ ui.encodeJavaScript(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
     ]);
 
     jq(function() {
         jq('.cancel').click(function(event) {
             event.preventDefault();
diff --git a/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithSimpleUi.gsp b/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithSimpleUi.gsp
index 798b220..4fa3d67 100644
--- a/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithSimpleUi.gsp
+++ b/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithSimpleUi.gsp
@@ -28,11 +28,11 @@ ${ ui.includeFragment("coreapps", "patientHeader", [ patient: patient ]) }
     var NavigatorController;
 
     var breadcrumbs = _.flatten([
         { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
         ${ ui.encodeHtmlContent(breadcrumbMiddle) } ,
-        { label: "${ ui.escapeJs(ui.format(htmlForm.form)) }" }
+        { label: "${ ui.encodeJavaScript(ui.format(htmlForm.form)) }" }
     ]);
 
     jQuery(function() {
         jq('input.submitButton').hide();
         jq('form#htmlform').append(jq('#confirmation-template').html());
diff --git a/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithStandardUi.gsp b/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithStandardUi.gsp
index 4ab90ee..db620af 100644
--- a/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithStandardUi.gsp
+++ b/omod/src/main/webapp/pages/htmlform/enterHtmlFormWithStandardUi.gsp
@@ -11,11 +11,11 @@
 
 <script type="text/javascript">
     var breadcrumbs = _.flatten([
         { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
         ${ breadcrumbMiddle },
-        { label: "${ ui.message(ui.escapeJs(ui.format(htmlForm.form)) )}" }
+        { label: "${ ui.message(ui.encodeJavaScript(ui.format(htmlForm.form)) )}" }
     ]);
 
     jq(function() {
         jq('.cancel').click(function(event) {
             event.preventDefault();
diff --git a/omod/src/main/webapp/pages/htmlform/viewEncounterWithHtmlForm.gsp b/omod/src/main/webapp/pages/htmlform/viewEncounterWithHtmlForm.gsp
index fa4f72b..0db0dad 100644
--- a/omod/src/main/webapp/pages/htmlform/viewEncounterWithHtmlForm.gsp
+++ b/omod/src/main/webapp/pages/htmlform/viewEncounterWithHtmlForm.gsp
@@ -6,18 +6,18 @@
 %>
 
 <script type="text/javascript">
     window.viewHtmlForm = {
         encounterId: ${ encounter.id },
-        returnUrl: "${ ui.escapeJs(returnUrl) }",
+        returnUrl: "${ ui.encodeJavaScript(returnUrl) }",
         htmlFormId: ${htmlForm.id}
     };
 
     var breadcrumbs = [
         { icon: "icon-home", link: '/' + OPENMRS_CONTEXT_PATH + '/index.htm' },
-        { label: "${ ui.escapeJs(returnLabel) }", link: "${ ui.escapeJs(returnUrl) }" },
-        { label: "${ ui.escapeJs(ui.message("htmlformentryui.viewHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
+        { label: "${ ui.encodeJavaScript(returnLabel) }", link: "${ ui.encodeJavaScript(returnUrl) }" },
+        { label: "${ ui.encodeJavaScript(ui.message("htmlformentryui.viewHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
     ];
 </script>
 
 <style type="text/css">
     #form-actions {

Vulnerable code: 			return ui.escapeJs(ui.format(patient));
		        ui.format(hf.getForm()), ui.escapeJs(ui.format(patient))));
			returnLabel = ui.escapeJs(ui.format(patient.getPatient()));
        { label: "${ ui.escapeJs(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
        { label: "${ ui.escapeJs(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
        { label: "${ ui.escapeJs(ui.format(htmlForm.form)) }" }
        { label: "${ ui.message(ui.escapeJs(ui.format(htmlForm.form)) )}" }
        returnUrl: "${ ui.escapeJs(returnUrl) }",
        { label: "${ ui.escapeJs(returnLabel) }", link: "${ ui.escapeJs(returnUrl) }" },
        { label: "${ ui.escapeJs(ui.message("htmlformentryui.viewHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
Fixed code: 			return ui.encodeJavaScript(ui.format(patient));
		        ui.format(hf.getForm()), ui.encodeJavaScript(ui.format(patient))));
			returnLabel = ui.encodeJavaScript(ui.format(patient.getPatient()));
        { label: "${ ui.encodeJavaScript(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
        { label: "${ ui.encodeJavaScript(ui.message("coreapps.editHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }
        { label: "${ ui.encodeJavaScript(ui.format(htmlForm.form)) }" }
        { label: "${ ui.message(ui.encodeJavaScript(ui.format(htmlForm.form)) )}" }
        returnUrl: "${ ui.encodeJavaScript(returnUrl) }",
        { label: "${ ui.encodeJavaScript(returnLabel) }", link: "${ ui.encodeJavaScript(returnUrl) }" },
        { label: "${ ui.encodeJavaScript(ui.message("htmlformentryui.viewHtmlForm.breadcrumb", ui.message(ui.format(htmlForm.form)))) }" }