CVE-2022-4727: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T15:15Z
Repository: https://github.com/openmrs/openmrs-module-appointmentscheduling
Language: Java
Files changed: api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java, api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java
Commit date: 2022-09-22 10:07:59 -0400
Commit message: RA1865 - Fixing reflected XSS in the notes section (#39)

* Fixing reflective XSS in the notes section

* using owasp encoder for HTML encoding

* Escaping HTML using WebUtil

* Update api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java

Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>

* Update api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java

Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>

Co-authored-by: Anupam Devulapalli <anupam.8010@gmail.com>
Co-authored-by: Mark Goodrich <mgoodrich@pih.org>
Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>
Diff: diff --git a/api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java b/api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java
index 4842f6bd..947fff75 100644
--- a/api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java
+++ b/api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java
@@ -1,10 +1,11 @@
 package org.openmrs.module.appointmentscheduling;
 
 import org.openmrs.BaseOpenmrsData;
 import org.openmrs.Patient;
 import org.openmrs.Provider;
+import org.openmrs.web.WebUtil;
 
 import java.util.Date;
 
 /**
  * persisted object that reflects a request by a provider (or other user) for a scheduler to schedule a patient for a future appointment;
@@ -93,11 +94,11 @@ public class AppointmentRequest extends BaseOpenmrsData {
     public String getNotes() {
         return notes;
     }
 
     public void setNotes(String notes) {
-        this.notes = notes;
+        this.notes = WebUtil.escapeHTML(notes);
     }
 
     public Provider getRequestedBy() {
         return requestedBy;
     }
diff --git a/api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java b/api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java
index 84722cf5..bb4543a3 100644
--- a/api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java
+++ b/api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java
@@ -82,12 +82,10 @@ public class AppointmentRequestServiceTest extends BaseModuleContextSensitiveTes
         assertEquals(providerService.getProvider(2), appointmentRequest.getRequestedBy());
         assertEquals(new Integer(6), appointmentRequest.getMinTimeFrameValue());
         assertEquals(TimeFrameUnits.WEEKS, appointmentRequest.getMinTimeFrameUnits());
         assertEquals(new Integer(2), appointmentRequest.getMaxTimeFrameValue());
         assertEquals(TimeFrameUnits.MONTHS, appointmentRequest.getMaxTimeFrameUnits());
-        assertNull(appointmentRequest.getNotes());
-
     }
 
     @Test
     @Verifies(value = "should get correct appointment request", method = "getAppointmentRequestByUuid(String)")
     public void getAppointmentRequestByUuid_shouldGetCorrectAppointmentRequest() throws Exception {
@@ -293,6 +291,16 @@ public class AppointmentRequestServiceTest extends BaseModuleContextSensitiveTes
         assertEquals(1, requests.size());
         assertEquals(new Integer(1), requests.get(0).getId());
 
     }
 
+    @Test
+    @Verifies(value="The text for notes should be sanitized", method="sanitizeNotes(String)")
+    public void sanitizeAppointmentRequest_shouldSanitizeTheTextInputForAppointmentNotes() throws Exception {
+        final String note = "<iframe>";
+        final String sanitizedNote = "&lt;iframe&gt;";
+        AppointmentRequest appointmentRequest = new AppointmentRequest();
+        appointmentRequest.setNotes(note);
+        assertEquals(appointmentRequest.getNotes(), sanitizedNote);
+    }
+
 }

Vulnerable code:         this.notes = notes;
        assertNull(appointmentRequest.getNotes());

Fixed code: import org.openmrs.web.WebUtil;
        this.notes = WebUtil.escapeHTML(notes);
    @Test
    @Verifies(value="The text for notes should be sanitized", method="sanitizeNotes(String)")
    public void sanitizeAppointmentRequest_shouldSanitizeTheTextInputForAppointmentNotes() throws Exception {
        final String note = "<iframe>";
        final String sanitizedNote = "&lt;iframe&gt;";
        AppointmentRequest appointmentRequest = new AppointmentRequest();
        appointmentRequest.setNotes(note);
        assertEquals(appointmentRequest.getNotes(), sanitizedNote);
    }