Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-30177: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-25T18:15Z
Repository: https://github.com/craftcms/cms
Language: PHP
Files changed: CHANGELOG.md, src/elements/Asset.php
Commit date: 2023-02-23 11:00:02 -0800
Commit message: Fixed an XSS vulnerability.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15e2fabcc3a..43b850099e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,11 @@
 # Release Notes for Craft CMS 3.x
 
 ## Unreleased
 - Fixed a bug where `craft\events\RegisterElementSourcesEvent::$context` wasn’t always set to `modal` when defining the available element sources for an element selection modal.
 - Fixed a styling bug where multi-line checkbox labels within the Customize Sources modal weren’t wrapping properly. ([#12717](https://github.com/craftcms/cms/issues/12717))
+- Fixed an XSS vulnerability.
 
 ## 3.7.67 - 2023-02-17
 
 - Fixed a bug where clicking on the scrollbar of a disclosure menu would close it. ([#12681](https://github.com/craftcms/cms/issues/12681))
 - Fixed an error that could occur when loading the Plugin Store, if there wasn’t a `.env` file. ([#12687](https://github.com/craftcms/cms/issues/12687))
diff --git a/src/elements/Asset.php b/src/elements/Asset.php
index 59526efc082..6336fca0fb8 100644
--- a/src/elements/Asset.php
+++ b/src/elements/Asset.php
@@ -1854,11 +1854,11 @@ class Asset extends Element
     {
         $volume = $this->getVolume();
 
         return [
             Craft::t('app', 'Location') => function() use ($volume) {
-                $loc = [Craft::t('site', $volume->name)];
+                $loc = [Html::encode(Craft::t('site', $volume->name))];
                 if ($this->folderPath) {
                     array_push($loc, ...ArrayHelper::filterEmptyStringsFromArray(explode('/', $this->folderPath)));
                 }
                 return implode(' → ', $loc);
             },

Vulnerable code:                 $loc = [Craft::t('site', $volume->name)];
Fixed code: - Fixed an XSS vulnerability.
                $loc = [Html::encode(Craft::t('site', $volume->name))];
CVE-2023-40035: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.2
Published: 2023-08-23T21:15Z
Repository: https://github.com/craftcms/cms
Language: PHP
Files changed: CHANGELOG.md, src/helpers/FileHelper.php
Commit date: 2023-06-27 16:49:40 -0700
Commit message: Fixed a potential RCE vulnerability

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 398ac8a4f42..6a893638371 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes for Craft CMS 3.x
 
+## Unreleased
+
+- Fixed an RCE vulnerability.
+
 ## 3.8.14 - 2023-06-13
 
 - The `_includes/forms/date` and `_includes/forms/time` templates now accept a `timeZone` variable.
 - Fixed an error that could occur when updating a plugin with the `craft update` command, if it provided a new migration but still had the same schema version.
 - Fixed an error that occurred when rendering editable tables with Date or Time columns. ([#13270](https://github.com/craftcms/cms/issues/13270))
diff --git a/src/helpers/FileHelper.php b/src/helpers/FileHelper.php
index 416725e5652..e3a25789f53 100644
--- a/src/helpers/FileHelper.php
+++ b/src/helpers/FileHelper.php
@@ -42,10 +42,13 @@ class FileHelper extends \yii\helpers\FileHelper
     /**
      * @inheritdoc
      */
     public static function normalizePath($path, $ds = DIRECTORY_SEPARATOR)
     {
+        // Remove any file protocol wrappers
+        $path = StringHelper::removeLeft($path, 'file://');
+
         // Is this a UNC network share path?
         $isUnc = (strpos($path, '//') === 0 || strpos($path, '\\\\') === 0);
 
         // Normalize the path
         $path = parent::normalizePath($path, $ds);

Fixed code: ## Unreleased

- Fixed an RCE vulnerability.

        // Remove any file protocol wrappers
        $path = StringHelper::removeLeft($path, 'file://');
CVE-2023-41892: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2023-09-13T20:15Z
Repository: https://github.com/craftcms/cms
Language: PHP
Files changed: src/controllers/ConditionsController.php
Commit date: 2023-06-27 17:16:27 -0700
Commit message: Take two

Diff: diff --git a/src/controllers/ConditionsController.php b/src/controllers/ConditionsController.php
index ba458375b306..dfcbc49771fd 100644
--- a/src/controllers/ConditionsController.php
+++ b/src/controllers/ConditionsController.php
@@ -39,11 +39,11 @@ class ConditionsController extends Controller
             return false;
         }
 
         $this->requireCpRequest();
 
-        $baseConfig = Json::decodeIfJson($this->request->getBodyParam('config'));
+        $baseConfig = Component::cleanseConfig(Json::decodeIfJson($this->request->getBodyParam('config')));
         $config = Component::cleanseConfig($this->request->getBodyParam($baseConfig['name']));
         $newRuleType = ArrayHelper::remove($config, 'new-rule-type');
         $conditionsService = Craft::$app->getConditions();
         $this->_condition = $conditionsService->createCondition($config);
         Craft::configure($this->_condition, $baseConfig);

Vulnerable code:         $baseConfig = Json::decodeIfJson($this->request->getBodyParam('config'));
Fixed code:         $baseConfig = Component::cleanseConfig(Json::decodeIfJson($this->request->getBodyParam('config')));
CVE-2024-21622: Insufficient Information (NVD-CWE-noinfo)
value: Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2024-01-03T17:15Z
Repository: https://github.com/craftcms/cms
Language: Unknown
Commit date: 2023-11-16 08:45:41 -0800
Commit message: Merge pull request #13932 from craftcms/bugfix/element-pe

Fixed a potential privilege escalation bug
CVE-2024-21622: Insufficient Information (NVD-CWE-noinfo)
value: Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2024-01-03T17:15Z
Repository: https://github.com/craftcms/cms
Language: Unknown
Commit date: 2023-11-16 08:40:54 -0800
Commit message: Merge pull request #13931 from craftcms/bugfix/user-perms

Fixed a potential privilege escalation bug
CVE-2023-23607: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.

CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-01-20T21:15Z
Repository: https://github.com/erohtar/Dasherr
Language: PHP
Files changed: www/include/filesave.php
Commit date: 2023-01-20 01:25:50 +0530
Commit message: Update filesave.php

Diff: diff --git a/www/include/filesave.php b/www/include/filesave.php
index 57a0e05..8a5d618 100644
--- a/www/include/filesave.php
+++ b/www/include/filesave.php
@@ -1,11 +1,11 @@
 <?php
 if(!empty($_POST['data'])){
 	$fname = $_POST['file'];
 
 	//check if file name ends with .json
-	if(substr($fname, -1, 5) != '.json') {
+	if(substr($fname, -5) != '.json') {
 		echo '<script>alert("ERROR: Incorrect file type submitted")</script>';
 		return;
 	}
 
 	$data = $_POST['data'];

Vulnerable code: 	if(substr($fname, -1, 5) != '.json') {
Fixed code: 	if(substr($fname, -5) != '.json') {
CVE-2016-10970: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-09-16T13:15Z
Repository: https://github.com/SupportFlow/supportflow
Language: PHP
Files changed: classes/class-supportflow-admin.php
Commit date: 2016-06-20 22:27:03 +0000
Commit message: Admin: Escape ticket excerpt on Tickets screen to avoid XSS.

An attacker could submit the following payload via `[supportflow_submissionform]` to perform cross-site-scripting:

`<script>alert('XSS');</script>`

That attack has a CVSS score of 6.1 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145091

Diff: diff --git a/classes/class-supportflow-admin.php b/classes/class-supportflow-admin.php
index e4ff6b4..c6dac90 100644
--- a/classes/class-supportflow-admin.php
+++ b/classes/class-supportflow-admin.php
@@ -1183,11 +1183,11 @@ class SupportFlow_Admin {
 				}
 				$first_reply = $replies[0]->post_content;
 				if ( strlen( $first_reply ) > 50 ) {
 					$first_reply = substr( $first_reply, 0, 50 );
 				}
-				echo $first_reply;
+				echo esc_html( $first_reply );
 				break;
 			case 'customers':
 				$customers = SupportFlow()->get_ticket_customers( $ticket_id, array( 'fields' => 'emails' ) );
 				if ( empty( $customers ) ) {
 					echo '—';

Vulnerable code: 				echo $first_reply;
Fixed code: 				echo esc_html( $first_reply );
CVE-2021-32434: Out-of-bounds Read (CWE-125)
value: abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-03-10T17:42Z
Repository: https://github.com/leesavide/abcm2ps
Language: C
Files changed: parse.c
Commit date: 2021-04-27 11:52:27 +0200
Commit message: fix: array overflow when wrong duration in voice overlay

Issue #83,

Diff: diff --git a/parse.c b/parse.c
index f4539cb..3bf0a7a 100644
--- a/parse.c
+++ b/parse.c
@@ -2009,13 +2009,18 @@ static char txt_no_note[] = "No note in voice overlay";
 		over_bar = 0;
 		if (over_time < 0) {
 			error(1, s, "Erroneous end of voice overlap");
 			return;
 		}
-		if (p_voice->time != over_mxtime)
-			error(1, s, tx_wrong_dur);
 		curvoice = &voice_tb[over_voice];
+		if (p_voice->time != over_mxtime) {
+			error(1, s, tx_wrong_dur);
+			if (p_voice->time > over_mxtime)
+				curvoice->time = p_voice->time;
+			else
+				p_voice->time = curvoice->time;
+		}
 		over_mxtime = 0;
 		over_voice = -1;
 		over_time = -1;
 		return;
 	}

Vulnerable code: 		if (p_voice->time != over_mxtime)
			error(1, s, tx_wrong_dur);
Fixed code: 		if (p_voice->time != over_mxtime) {
			error(1, s, tx_wrong_dur);
			if (p_voice->time > over_mxtime)
				curvoice->time = p_voice->time;
			else
				p_voice->time = curvoice->time;
		}
CVE-2021-32435: Out-of-bounds Write (CWE-787)
value: Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-03-10T17:42Z
Repository: https://github.com/leesavide/abcm2ps
Language: C
Files changed: abcparse.c
Commit date: 2021-04-27 16:39:19 +0200
Commit message: fix: crash when accidental without a note at start of line after K:

Issue #84.

Diff: diff --git a/abcparse.c b/abcparse.c
index 07ee3e4..f803fb3 100644
--- a/abcparse.c
+++ b/abcparse.c
@@ -2038,14 +2038,14 @@ static int parse_line(char *p)
 //			s->u.eoln.type = 0;
 			break;
 		case CHAR_NOTE:
 			p = parse_note(p - 1, flags);
 			flags &= ABC_F_GRACE;
-			parse.last_sym->u.note.slur_st = slur;
-			slur = 0;
-			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */
-				curvoice->last_note = parse.last_sym;
+			if (slur && parse.last_sym->u.note.notes[0].len) {
+				parse.last_sym->u.note.slur_st = slur;
+				slur = 0;
+			}
 			break;
 		case CHAR_SLASH:		/* '/' */
 			if (flags & ABC_F_GRACE)
 				goto bad_char;
 			if (char_tb[(unsigned char) p[-1]] != CHAR_BAR)
@@ -2076,13 +2076,14 @@ static int parse_line(char *p)
 				break;
 			}
 			if (p[1] != ':') {
 				p = parse_note(p - 1, flags); /* chord */
 				flags &= ABC_F_GRACE;
-				parse.last_sym->u.note.slur_st = slur;
-				slur = 0;
-				curvoice->last_note = parse.last_sym;
+				if (slur && parse.last_sym->u.note.notes[0].len) {
+					parse.last_sym->u.note.slur_st = slur;
+					slur = 0;
+				}
 				break;
 			}
 
 			/* embedded information field */
 #if 0
@@ -2509,10 +2510,12 @@ add_deco:
 	/* forbid rests in grace note sequences */
 	if (s->abc_type != ABC_T_NOTE && (flags & ABC_F_GRACE)) {
 		syntax("Not a note in grace note sequence", p);
 		goto err;
 	}
+	if (s->u.note.notes[0].len > 0) /* if not space */
+		curvoice->last_note = s;
 	return p;
 
 err:
 	if ((parse.last_sym = s->abc_prev) == NULL) {
 		parse.first_sym = NULL;

Vulnerable code: 			parse.last_sym->u.note.slur_st = slur;
			slur = 0;
			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */
				curvoice->last_note = parse.last_sym;
				parse.last_sym->u.note.slur_st = slur;
				slur = 0;
				curvoice->last_note = parse.last_sym;
Fixed code: 			if (slur && parse.last_sym->u.note.notes[0].len) {
				parse.last_sym->u.note.slur_st = slur;
				slur = 0;
			}
				if (slur && parse.last_sym->u.note.notes[0].len) {
					parse.last_sym->u.note.slur_st = slur;
					slur = 0;
				}
	if (s->u.note.notes[0].len > 0) /* if not space */
		curvoice->last_note = s;
CVE-2021-32436: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2022-03-10T17:42Z
Repository: https://github.com/leesavide/abcm2ps
Language: C
Files changed: parse.c
Commit date: 2021-04-27 11:52:27 +0200
Commit message: fix: array overflow when wrong duration in voice overlay

Issue #83,

Diff: diff --git a/parse.c b/parse.c
index f4539cb..3bf0a7a 100644
--- a/parse.c
+++ b/parse.c
@@ -2009,13 +2009,18 @@ static char txt_no_note[] = "No note in voice overlay";
 		over_bar = 0;
 		if (over_time < 0) {
 			error(1, s, "Erroneous end of voice overlap");
 			return;
 		}
-		if (p_voice->time != over_mxtime)
-			error(1, s, tx_wrong_dur);
 		curvoice = &voice_tb[over_voice];
+		if (p_voice->time != over_mxtime) {
+			error(1, s, tx_wrong_dur);
+			if (p_voice->time > over_mxtime)
+				curvoice->time = p_voice->time;
+			else
+				p_voice->time = curvoice->time;
+		}
 		over_mxtime = 0;
 		over_voice = -1;
 		over_time = -1;
 		return;
 	}

Vulnerable code: 		if (p_voice->time != over_mxtime)
			error(1, s, tx_wrong_dur);
Fixed code: 		if (p_voice->time != over_mxtime) {
			error(1, s, tx_wrong_dur);
			if (p_voice->time > over_mxtime)
				curvoice->time = p_voice->time;
			else
				p_voice->time = curvoice->time;
		}
CVE-2022-46147: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-28T21:15Z
Repository: https://github.com/openedx/xblock-drag-and-drop-v2
Language: Unknown
Commit date: 2022-11-28 09:52:39 -0500
Commit message: Merge pull request from GHSA-qv6c-367r-3w6q

feat: sanitize HTML tags to prevent XSS vulnerabilities
CVE-2024-23826: Allocation of Resources Without Limits or Throttling (CWE-770)
value: spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS.  This vulnerability was fixed in the 2024.01.29 release.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 5.7
Published: 2024-01-29T16:15Z
Repository: https://github.com/spbu-se/spbu_se_site
Language: Python
Files changed: src/flask_se_auth.py
Commit date: 2024-01-27 21:44:07 +0300
Commit message: Fix possible server-size DoS vulnerability

Signed-off-by: Kirill K. Smirnov <kirill.k.smirnov@gmail.com>

Diff: diff --git a/src/flask_se_auth.py b/src/flask_se_auth.py
index 4f2a4c8..fd0ae25 100644
--- a/src/flask_se_auth.py
+++ b/src/flask_se_auth.py
@@ -246,10 +246,16 @@ def upload_avatar():
         # If the user does not select a file, the browser submits an
         # empty file without a filename.
         if file.filename == "":
             flash("No selected file")
             return redirect(request.url)
+        # Sanity check: limit uploadable filename
+        # to avoid excessive burden to NFKD normalization
+        # in secure_filename() method
+        if len(file.filename) > 1000:
+            flash("Filename too long")
+            return redirect(request.url)
         if file and allowed_file(file.filename):
             filename = secure_filename(file.filename)
             new_filename = os.urandom(16).hex()
             f, ext = os.path.splitext(filename)
 

Fixed code:         # Sanity check: limit uploadable filename
        # to avoid excessive burden to NFKD normalization
        # in secure_filename() method
        if len(file.filename) > 1000:
            flash("Filename too long")
            return redirect(request.url)
CVE-2023-0740: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-02-08T08:15Z
Repository: https://github.com/answerdev/answer
Language: Unknown
Commit date: 2023-02-07 10:00:54 +0000
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438
CVE-2023-0741: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-02-08T08:15Z
Repository: https://github.com/answerdev/answer
Language: Unknown
Commit date: 2023-02-07 10:00:54 +0000
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438
CVE-2023-0742: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-02-08T08:15Z
Repository: https://github.com/answerdev/answer
Language: Unknown
Commit date: 2023-02-07 10:00:54 +0000
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438
CVE-2023-0743: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2023-02-08T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/base/middleware/avatar.go
Commit date: 2023-02-07 17:55:31 +0800
Commit message: update img header

Diff: diff --git a/internal/base/middleware/avatar.go b/internal/base/middleware/avatar.go
index 66a72f68..d38e76c9 100644
--- a/internal/base/middleware/avatar.go
+++ b/internal/base/middleware/avatar.go
@@ -2,10 +2,11 @@ package middleware
 
 import (
 	"fmt"
 	"net/url"
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 
 	"github.com/answerdev/answer/internal/service/service_config"
 	"github.com/answerdev/answer/internal/service/uploader"
@@ -51,16 +52,29 @@ func (am *AvatarMiddleware) AvatarThumb() gin.HandlerFunc {
 			}
 			if err != nil {
 				ctx.Next()
 				return
 			}
+			ext := strings.ToLower(path.Ext(filePath)[1:])
+			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
 			_, err = ctx.Writer.WriteString(string(avatarfile))
 			if err != nil {
 				log.Error(err)
 			}
 			ctx.Abort()
 			return
 
+		} else {
+			uUrl, err := url.Parse(u)
+			if err != nil {
+				ctx.Next()
+				return
+			}
+			_, urlfileName := filepath.Split(uUrl.Path)
+			uploadPath := am.serviceConfig.UploadPath
+			filePath := fmt.Sprintf("%s/%s", uploadPath, urlfileName)
+			ext := strings.ToLower(path.Ext(filePath)[1:])
+			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
 		}
 		ctx.Next()
 	}
 }

Fixed code: 	"path"
			ext := strings.ToLower(path.Ext(filePath)[1:])
			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
		} else {
			uUrl, err := url.Parse(u)
			if err != nil {
				ctx.Next()
				return
			}
			_, urlfileName := filepath.Split(uUrl.Path)
			uploadPath := am.serviceConfig.UploadPath
			filePath := fmt.Sprintf("%s/%s", uploadPath, urlfileName)
			ext := strings.ToLower(path.Ext(filePath)[1:])
			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
CVE-2023-0744: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2023-02-08T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/controller/user_controller.go
Commit date: 2023-01-31 10:04:52 +0800
Commit message: fix  RetrievePassWord code

Diff: diff --git a/internal/controller/user_controller.go b/internal/controller/user_controller.go
index 909581cc..c2cf25bf 100644
--- a/internal/controller/user_controller.go
+++ b/internal/controller/user_controller.go
@@ -155,12 +155,12 @@ func (uc *UserController) RetrievePassWord(ctx *gin.Context) {
 		})
 		handler.HandleResponse(ctx, errors.BadRequest(reason.CaptchaVerificationFailed), errFields)
 		return
 	}
 	_, _ = uc.actionService.ActionRecordAdd(ctx, schema.ActionRecordTypeFindPass, ctx.ClientIP())
-	code, err := uc.userService.RetrievePassWord(ctx, req)
-	handler.HandleResponse(ctx, err, code)
+	_, err := uc.userService.RetrievePassWord(ctx, req)
+	handler.HandleResponse(ctx, err, nil)
 }
 
 // UseRePassWord godoc
 // @Summary UseRePassWord
 // @Description UseRePassWord

Vulnerable code: 	code, err := uc.userService.RetrievePassWord(ctx, req)
	handler.HandleResponse(ctx, err, code)
Fixed code: 	_, err := uc.userService.RetrievePassWord(ctx, req)
	handler.HandleResponse(ctx, err, nil)
CVE-2023-1237: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Other
Files changed: ui/src/components/Comment/index.tsx
Commit date: 2023-02-24 17:52:17 +0800
Commit message: fix(comment): Resolving xss issues in comments

Diff: diff --git a/ui/src/components/Comment/index.tsx b/ui/src/components/Comment/index.tsx
index 6f42a559d..2101f4dab 100644
--- a/ui/src/components/Comment/index.tsx
+++ b/ui/src/components/Comment/index.tsx
@@ -3,11 +3,10 @@ import { Button } from 'react-bootstrap';
 import { useTranslation } from 'react-i18next';
 import { Link } from 'react-router-dom';
 
 import classNames from 'classnames';
 import { unionBy } from 'lodash';
-import { marked } from 'marked';
 
 import * as Types from '@/common/interface';
 import { Modal } from '@/components';
 import { usePageUsers, useReportModal } from '@/hooks';
 import {
@@ -106,19 +105,15 @@ const Comment = ({ objectId, mode, commentId }) => {
 
   const handleSendReply = (item) => {
     const users = matchedUsers(item.value);
     const userNames = unionBy(users.map((user) => user.userName));
     const commentMarkDown = parseUserInfo(item.value);
-    const html = marked.parse(commentMarkDown);
-    // if (!commentMarkDown || !html) {
-    //   return;
-    // }
+
     const params = {
       object_id: objectId,
       original_text: commentMarkDown,
       mention_username_list: userNames,
-      parsed_text: html,
       ...(item.type === 'reply'
         ? {
             reply_comment_id: item.comment_id,
           }
         : {}),
@@ -126,17 +121,17 @@ const Comment = ({ objectId, mode, commentId }) => {
 
     if (item.type === 'edit') {
       return updateComment({
         ...params,
         comment_id: item.comment_id,
-      }).then(() => {
+      }).then((res) => {
         setComments(
           comments.map((comment) => {
             if (comment.comment_id === item.comment_id) {
               comment.showEdit = false;
-              comment.parsed_text = html;
-              comment.original_text = item.value;
+              comment.parsed_text = res.parsed_text;
+              comment.original_text = res.original_text;
             }
             return comment;
           }),
         );
       });

Vulnerable code: import { marked } from 'marked';
    const html = marked.parse(commentMarkDown);
    // if (!commentMarkDown || !html) {
    //   return;
    // }
      parsed_text: html,
      }).then(() => {
              comment.parsed_text = html;
              comment.original_text = item.value;
Fixed code: 
      }).then((res) => {
              comment.parsed_text = res.parsed_text;
              comment.original_text = res.original_text;
CVE-2023-1238: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Other
Files changed: ui/src/components/Comment/index.tsx
Commit date: 2023-02-24 17:52:17 +0800
Commit message: fix(comment): Resolving xss issues in comments

Diff: diff --git a/ui/src/components/Comment/index.tsx b/ui/src/components/Comment/index.tsx
index 6f42a559d..2101f4dab 100644
--- a/ui/src/components/Comment/index.tsx
+++ b/ui/src/components/Comment/index.tsx
@@ -3,11 +3,10 @@ import { Button } from 'react-bootstrap';
 import { useTranslation } from 'react-i18next';
 import { Link } from 'react-router-dom';
 
 import classNames from 'classnames';
 import { unionBy } from 'lodash';
-import { marked } from 'marked';
 
 import * as Types from '@/common/interface';
 import { Modal } from '@/components';
 import { usePageUsers, useReportModal } from '@/hooks';
 import {
@@ -106,19 +105,15 @@ const Comment = ({ objectId, mode, commentId }) => {
 
   const handleSendReply = (item) => {
     const users = matchedUsers(item.value);
     const userNames = unionBy(users.map((user) => user.userName));
     const commentMarkDown = parseUserInfo(item.value);
-    const html = marked.parse(commentMarkDown);
-    // if (!commentMarkDown || !html) {
-    //   return;
-    // }
+
     const params = {
       object_id: objectId,
       original_text: commentMarkDown,
       mention_username_list: userNames,
-      parsed_text: html,
       ...(item.type === 'reply'
         ? {
             reply_comment_id: item.comment_id,
           }
         : {}),
@@ -126,17 +121,17 @@ const Comment = ({ objectId, mode, commentId }) => {
 
     if (item.type === 'edit') {
       return updateComment({
         ...params,
         comment_id: item.comment_id,
-      }).then(() => {
+      }).then((res) => {
         setComments(
           comments.map((comment) => {
             if (comment.comment_id === item.comment_id) {
               comment.showEdit = false;
-              comment.parsed_text = html;
-              comment.original_text = item.value;
+              comment.parsed_text = res.parsed_text;
+              comment.original_text = res.original_text;
             }
             return comment;
           }),
         );
       });

Vulnerable code: import { marked } from 'marked';
    const html = marked.parse(commentMarkDown);
    // if (!commentMarkDown || !html) {
    //   return;
    // }
      parsed_text: html,
      }).then(() => {
              comment.parsed_text = html;
              comment.original_text = item.value;
Fixed code: 
      }).then((res) => {
              comment.parsed_text = res.parsed_text;
              comment.original_text = res.original_text;
CVE-2023-1239: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/install/install_req.go
Commit date: 2023-02-24 16:06:54 +0800
Commit message: update site_name sanitizer

Diff: diff --git a/internal/install/install_req.go b/internal/install/install_req.go
index a465d6bd4..96e166383 100644
--- a/internal/install/install_req.go
+++ b/internal/install/install_req.go
@@ -76,11 +76,11 @@ type InitEnvironmentResp struct {
 }
 
 // InitBaseInfoReq init base info request
 type InitBaseInfoReq struct {
 	Language      string `validate:"required,gt=0,lte=30" json:"lang"`
-	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
+	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
 	SiteURL       string `validate:"required,gt=0,lte=512,url" json:"site_url"`
 	ContactEmail  string `validate:"required,email,gt=0,lte=500" json:"contact_email"`
 	AdminName     string `validate:"required,gt=3,lte=30" json:"name"`
 	AdminPassword string `validate:"required,gte=8,lte=32" json:"password"`
 	AdminEmail    string `validate:"required,email,gt=0,lte=500" json:"email"`

Vulnerable code: 	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
Fixed code: 	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
CVE-2023-1240: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/schema/tag_schema.go
Commit date: 2023-02-24 18:03:52 +0800
Commit message: update GetExcerpt

Diff: diff --git a/internal/schema/tag_schema.go b/internal/schema/tag_schema.go
index cc046b37b..3eb8d3897 100644
--- a/internal/schema/tag_schema.go
+++ b/internal/schema/tag_schema.go
@@ -88,11 +88,11 @@ type GetTagResp struct {
 	Recommend       bool   `json:"recommend"`
 	Reserved        bool   `json:"reserved"`
 }
 
 func (tr *GetTagResp) GetExcerpt() {
-	excerpt := strings.TrimSpace(tr.OriginalText)
+	excerpt := strings.TrimSpace(tr.ParsedText)
 	idx := strings.Index(excerpt, "\n")
 	if idx >= 0 {
 		excerpt = excerpt[0:idx]
 	}
 	tr.Excerpt = excerpt

Vulnerable code: 	excerpt := strings.TrimSpace(tr.OriginalText)
Fixed code: 	excerpt := strings.TrimSpace(tr.ParsedText)
CVE-2023-1241: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/schema/tag_schema.go
Commit date: 2023-02-24 18:03:52 +0800
Commit message: update GetExcerpt

Diff: diff --git a/internal/schema/tag_schema.go b/internal/schema/tag_schema.go
index cc046b37b..3eb8d3897 100644
--- a/internal/schema/tag_schema.go
+++ b/internal/schema/tag_schema.go
@@ -88,11 +88,11 @@ type GetTagResp struct {
 	Recommend       bool   `json:"recommend"`
 	Reserved        bool   `json:"reserved"`
 }
 
 func (tr *GetTagResp) GetExcerpt() {
-	excerpt := strings.TrimSpace(tr.OriginalText)
+	excerpt := strings.TrimSpace(tr.ParsedText)
 	idx := strings.Index(excerpt, "\n")
 	if idx >= 0 {
 		excerpt = excerpt[0:idx]
 	}
 	tr.Excerpt = excerpt

Vulnerable code: 	excerpt := strings.TrimSpace(tr.OriginalText)
Fixed code: 	excerpt := strings.TrimSpace(tr.ParsedText)
CVE-2023-1242: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/schema/tag_schema.go
Commit date: 2023-02-24 18:03:52 +0800
Commit message: update GetExcerpt

Diff: diff --git a/internal/schema/tag_schema.go b/internal/schema/tag_schema.go
index cc046b37b..3eb8d3897 100644
--- a/internal/schema/tag_schema.go
+++ b/internal/schema/tag_schema.go
@@ -88,11 +88,11 @@ type GetTagResp struct {
 	Recommend       bool   `json:"recommend"`
 	Reserved        bool   `json:"reserved"`
 }
 
 func (tr *GetTagResp) GetExcerpt() {
-	excerpt := strings.TrimSpace(tr.OriginalText)
+	excerpt := strings.TrimSpace(tr.ParsedText)
 	idx := strings.Index(excerpt, "\n")
 	if idx >= 0 {
 		excerpt = excerpt[0:idx]
 	}
 	tr.Excerpt = excerpt

Vulnerable code: 	excerpt := strings.TrimSpace(tr.OriginalText)
Fixed code: 	excerpt := strings.TrimSpace(tr.ParsedText)
CVE-2023-1243: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/install/install_req.go
Commit date: 2023-02-24 16:06:54 +0800
Commit message: update site_name sanitizer

Diff: diff --git a/internal/install/install_req.go b/internal/install/install_req.go
index a465d6bd4..96e166383 100644
--- a/internal/install/install_req.go
+++ b/internal/install/install_req.go
@@ -76,11 +76,11 @@ type InitEnvironmentResp struct {
 }
 
 // InitBaseInfoReq init base info request
 type InitBaseInfoReq struct {
 	Language      string `validate:"required,gt=0,lte=30" json:"lang"`
-	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
+	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
 	SiteURL       string `validate:"required,gt=0,lte=512,url" json:"site_url"`
 	ContactEmail  string `validate:"required,email,gt=0,lte=500" json:"contact_email"`
 	AdminName     string `validate:"required,gt=3,lte=30" json:"name"`
 	AdminPassword string `validate:"required,gte=8,lte=32" json:"password"`
 	AdminEmail    string `validate:"required,email,gt=0,lte=500" json:"email"`

Vulnerable code: 	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
Fixed code: 	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
CVE-2023-1244: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/install/install_req.go
Commit date: 2023-02-24 16:06:54 +0800
Commit message: update site_name sanitizer

Diff: diff --git a/internal/install/install_req.go b/internal/install/install_req.go
index a465d6bd4..96e166383 100644
--- a/internal/install/install_req.go
+++ b/internal/install/install_req.go
@@ -76,11 +76,11 @@ type InitEnvironmentResp struct {
 }
 
 // InitBaseInfoReq init base info request
 type InitBaseInfoReq struct {
 	Language      string `validate:"required,gt=0,lte=30" json:"lang"`
-	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
+	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
 	SiteURL       string `validate:"required,gt=0,lte=512,url" json:"site_url"`
 	ContactEmail  string `validate:"required,email,gt=0,lte=500" json:"contact_email"`
 	AdminName     string `validate:"required,gt=3,lte=30" json:"name"`
 	AdminPassword string `validate:"required,gte=8,lte=32" json:"password"`
 	AdminEmail    string `validate:"required,email,gt=0,lte=500" json:"email"`

Vulnerable code: 	SiteName      string `validate:"required,gt=0,lte=30" json:"site_name"`
Fixed code: 	SiteName      string `validate:"required,sanitizer,gt=0,lte=30" json:"site_name"`
CVE-2023-1245: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-07T08:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/schema/user_schema.go, pkg/converter/markdown.go
Commit date: 2023-02-22 18:19:30 +0800
Commit message: update user about me markdown

Diff: diff --git a/internal/schema/user_schema.go b/internal/schema/user_schema.go
index 308568c8a..dcc8ad895 100644
--- a/internal/schema/user_schema.go
+++ b/internal/schema/user_schema.go
@@ -307,11 +307,11 @@ func (req *UpdateInfoRequest) Check() (errFields []*validator.FormErrorField, er
 			}
 			errFields = append(errFields, errField)
 			return errFields, errors.BadRequest(reason.UsernameInvalid)
 		}
 	}
-	req.BioHTML = converter.Markdown2HTML(req.Bio)
+	req.BioHTML = converter.Markdown2BasicHTML(req.Bio)
 	return nil, nil
 }
 
 // UpdateUserInterfaceRequest update user interface request
 type UpdateUserInterfaceRequest struct {
diff --git a/pkg/converter/markdown.go b/pkg/converter/markdown.go
index d61d79f94..b1e2a4185 100644
--- a/pkg/converter/markdown.go
+++ b/pkg/converter/markdown.go
@@ -33,10 +33,21 @@ func Markdown2HTML(source string) string {
 		return source
 	}
 	return buf.String()
 }
 
+// Markdown2BasicHTML convert markdown to html ,Only basic syntax can be used
+func Markdown2BasicHTML(source string) string {
+	content := Markdown2HTML(source)
+	filter := bluemonday.NewPolicy()
+	filter.AllowElements("p", "b", "br")
+	filter.AllowAttrs("src").OnElements("img")
+	filter.AddSpaceWhenStrippingTag(true)
+	content = filter.Sanitize(content)
+	return content
+}
+
 type DangerousHTMLFilterExtension struct {
 }
 
 func (e *DangerousHTMLFilterExtension) Extend(m goldmark.Markdown) {
 	m.Renderer().AddOptions(renderer.WithNodeRenderers(

Vulnerable code: 	req.BioHTML = converter.Markdown2HTML(req.Bio)
Fixed code: 	req.BioHTML = converter.Markdown2BasicHTML(req.Bio)
// Markdown2BasicHTML convert markdown to html ,Only basic syntax can be used
func Markdown2BasicHTML(source string) string {
	content := Markdown2HTML(source)
	filter := bluemonday.NewPolicy()
	filter.AllowElements("p", "b", "br")
	filter.AllowAttrs("src").OnElements("img")
	filter.AddSpaceWhenStrippingTag(true)
	content = filter.Sanitize(content)
	return content
}
CVE-2023-1535: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: pkg/converter/markdown.go
Commit date: 2023-03-10 15:20:45 +0800
Commit message: update markdown xss

Diff: diff --git a/pkg/converter/markdown.go b/pkg/converter/markdown.go
index b1e2a4185..f6e76c450 100644
--- a/pkg/converter/markdown.go
+++ b/pkg/converter/markdown.go
@@ -30,11 +30,14 @@ func Markdown2HTML(source string) string {
 	var buf bytes.Buffer
 	if err := mdConverter.Convert([]byte(source), &buf); err != nil {
 		log.Error(err)
 		return source
 	}
-	return buf.String()
+	html := buf.String()
+	filter := bluemonday.NewPolicy()
+	html = filter.Sanitize(html)
+	return html
 }
 
 // Markdown2BasicHTML convert markdown to html ,Only basic syntax can be used
 func Markdown2BasicHTML(source string) string {
 	content := Markdown2HTML(source)

Vulnerable code: 	return buf.String()
Fixed code: 	html := buf.String()
	filter := bluemonday.NewPolicy()
	html = filter.Sanitize(html)
	return html
CVE-2023-1536: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: pkg/converter/markdown.go
Commit date: 2023-03-10 15:20:45 +0800
Commit message: update markdown xss

Diff: diff --git a/pkg/converter/markdown.go b/pkg/converter/markdown.go
index b1e2a4185..f6e76c450 100644
--- a/pkg/converter/markdown.go
+++ b/pkg/converter/markdown.go
@@ -30,11 +30,14 @@ func Markdown2HTML(source string) string {
 	var buf bytes.Buffer
 	if err := mdConverter.Convert([]byte(source), &buf); err != nil {
 		log.Error(err)
 		return source
 	}
-	return buf.String()
+	html := buf.String()
+	filter := bluemonday.NewPolicy()
+	html = filter.Sanitize(html)
+	return html
 }
 
 // Markdown2BasicHTML convert markdown to html ,Only basic syntax can be used
 func Markdown2BasicHTML(source string) string {
 	content := Markdown2HTML(source)

Vulnerable code: 	return buf.String()
Fixed code: 	html := buf.String()
	filter := bluemonday.NewPolicy()
	html = filter.Sanitize(html)
	return html