CVE-2022-2065: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-06-13T13:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/App/AppRouter.php
Commit date: 2022-04-28 11:55:32 +0200
Commit message: Force to download SVG files to prevent security problems.
------
Forzamos a descargar los archivos SVG para evitar problemas de seguridad.

Diff: diff --git a/Core/App/AppRouter.php b/Core/App/AppRouter.php
index 1eed63f833..1de2d09bc9 100644
--- a/Core/App/AppRouter.php
+++ b/Core/App/AppRouter.php
@@ -125,28 +125,20 @@ final class AppRouter
 
         // Allowed folder?
         $allowedFolders = ['node_modules', 'vendor', 'Dinamic', 'Core', 'Plugins', 'MyFiles/Public'];
         foreach ($allowedFolders as $folder) {
             if ('/' . $folder === substr($uri, 0, 1 + strlen($folder))) {
-                header('Content-Type: ' . $this->getMime($filePath));
-                readfile($filePath);
+                $this->download($filePath);
                 return true;
             }
         }
 
         // MyFiles and token?
         $token = filter_input(INPUT_GET, 'myft');
         $fixedFilePath = substr(urldecode($uri), 1);
         if ('/MyFiles/' === substr($uri, 0, 9) && $token && MyFilesToken::validate($fixedFilePath, $token)) {
-            header('Content-Type: ' . $this->getMime($filePath));
-
-            // disable the buffer if enabled
-            if (ob_get_contents()) {
-                ob_end_flush();
-            }
-
-            readfile($filePath);
+            $this->download($filePath);
             return true;
         }
 
         return false;
     }
@@ -203,10 +195,27 @@ final class AppRouter
             $pluginManager = new PluginManager();
             $pluginManager->deploy();
         }
     }
 
+    private function download(string $filePath)
+    {
+        header('Content-Type: ' . $this->getMime($filePath));
+
+        // disable the buffer if enabled
+        if (ob_get_contents()) {
+            ob_end_flush();
+        }
+
+        // force to download svg files to prevent XSS attacks
+        if (strpos($filePath, '.svg') !== false) {
+            header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
+        }
+
+        readfile($filePath);
+    }
+
     /**
      * Return the mime type from given file.
      *
      * @param string $filePath
      *

Vulnerable code:                 header('Content-Type: ' . $this->getMime($filePath));
                readfile($filePath);
            header('Content-Type: ' . $this->getMime($filePath));

            // disable the buffer if enabled
            if (ob_get_contents()) {
                ob_end_flush();
            }

            readfile($filePath);
Fixed code:                 $this->download($filePath);
            $this->download($filePath);
    private function download(string $filePath)
    {
        header('Content-Type: ' . $this->getMime($filePath));

        // disable the buffer if enabled
        if (ob_get_contents()) {
            ob_end_flush();
        }

        // force to download svg files to prevent XSS attacks
        if (strpos($filePath, '.svg') !== false) {
            header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
        }

        readfile($filePath);
    }