CVE-2017-20176: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file new_window.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is fb6fae2f8a9b146471450b5b0281046a17d1ac8d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220204.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-06T04:15Z
Repository: https://github.com/ciubotaru/share-on-diaspora
Language: PHP
Files changed: trunk/new_window.php
Commit date: 2017-08-23 18:12:26 +0900
Commit message: Fix reflected XSS in new_window.php

Diff: diff --git a/trunk/new_window.php b/trunk/new_window.php
index 92ec3e3..e7a48d8 100644
--- a/trunk/new_window.php
+++ b/trunk/new_window.php
@@ -40,10 +40,20 @@ span.check{display:inline-block;background:#f5f5f5;margin:10px 6px 3px;border:1p
 span.check label{display:inline-block;font-size:14px;-webkit-transition:color .2s ease;-moz-transition:color .2s ease;-o-transition:color .2s ease;transition:color .2s ease;padding:5px 6px 4px 0}
 div.bot_opt{position:fixed;bottom:0;height:1.6em;border-top:1px solid #eee;left:0;right:0;width:auto;background:#82A6B6}div.bot_opt label{display:inline-block;width:auto;left:0;right:0;position:absolute;padding-left:1.6em;top:0;bottom:0;height:auto;-webkit-transition:color .2s ease;-moz-transition:color .2s ease;-o-transition:color .2s ease;transition:color .2s ease;margin:0}.advanced{padding:10px 0 0 20px}#contopt{apadding-top:6px;line-height:1.2em}#contopt input[type=checkbox]{margin-left:0}a.openao,.opttit{font-size:13px}section#podlist a.hidepod,.hideopt{display:none}span.check input:checked + label,div.bot_opt :checked + label{color:#060}
 </style>
 
 <script type="text/javascript">
+// Use to prevent XSS
+// Code from http://shebang.brandonmintern.com/foolproof-html-escaping-in-javascript/
+// Use the browser's built-in functionality to quickly and safely escape
+// the string
+function escapeHtml(str) {
+    var div = document.createElement('div');
+    div.appendChild(document.createTextNode(str));
+    return div.innerHTML;
+}
+
 function extras(a) {
     var b = document.getElementById("remember").checked;
     var c = document.getElementById("markdown").checked;
     var d = document.getElementById("shorten").checked;
     var e = document.getElementById("norem").checked;
@@ -250,21 +260,21 @@ function redirect() {
     if (title === "" && url === "") {
         document.getElementsByTagName("body")[0].innerHTML = "";
         location.href = "about"
     } else {
         if (localStorage["remember"] && localStorage["remember"] === "true" && localStorage["lastPod"] && redir !== "false") {
-            document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + title + "</b> (" + url + ") to " + localStorage["lastPod"];
+            document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + escapeHtml(title) + "</b> (" + escapeHtml(url) + ") to " + escapeHtml(localStorage["lastPod"]);
             var a = "http://" + localStorage["lastPod"] + "/bookmarklet?url=" + encodeURIComponent(url) + "&title=" + encodeURIComponent(title);
             if (notes !== "") {
                 a += "&notes=" + encodeURIComponent(notes)
             }
             a += "&jump=doclose";
             location.href = a;
             return true
         } else {
             document.getElementById("sharetitle").value = title;
-            document.getElementById("shareurl").innerHTML = url;
+            document.getElementById("shareurl").innerHTML = escapeHtml(url);
             crealinks();
             return false
         }
     }
 }

Vulnerable code:             document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + title + "</b> (" + url + ") to " + localStorage["lastPod"];
            document.getElementById("shareurl").innerHTML = url;
Fixed code: // Use to prevent XSS
// Code from http://shebang.brandonmintern.com/foolproof-html-escaping-in-javascript/
// Use the browser's built-in functionality to quickly and safely escape
// the string
function escapeHtml(str) {
    var div = document.createElement('div');
    div.appendChild(document.createTextNode(str));
    return div.innerHTML;
}

            document.getElementsByTagName('body')[0].innerHTML = "Sharing <b>" + escapeHtml(title) + "</b> (" + escapeHtml(url) + ") to " + escapeHtml(localStorage["lastPod"]);
            document.getElementById("shareurl").innerHTML = escapeHtml(url);