CVE-2022-0282: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.5
Published: 2022-01-20T12:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Comment/Models/Comment.php, src/MicroweberPackages/Comment/Models/CommentsCrud.php, src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php, userfiles/modules/comments/src/Controllers/Admin.php
Commit date: 2022-01-19 12:17:24 +0200
Commit message: fix comments xss

Diff: diff --git a/src/MicroweberPackages/Comment/Models/Comment.php b/src/MicroweberPackages/Comment/Models/Comment.php
index 20d2625ea6..4bb3f6d746 100644
--- a/src/MicroweberPackages/Comment/Models/Comment.php
+++ b/src/MicroweberPackages/Comment/Models/Comment.php
@@ -23,10 +23,11 @@ class Comment extends Model
 
 //    protected $casts = [
 //        'comment_body'=>MarkdownCast::class
 //    ];
 
+
     public function modelFilter()
     {
         return $this->provideFilter(ContentFilter::class);
     }
 
diff --git a/src/MicroweberPackages/Comment/Models/CommentsCrud.php b/src/MicroweberPackages/Comment/Models/CommentsCrud.php
index 2024169d6a..a21a469d9a 100644
--- a/src/MicroweberPackages/Comment/Models/CommentsCrud.php
+++ b/src/MicroweberPackages/Comment/Models/CommentsCrud.php
@@ -52,11 +52,11 @@ class CommentsCrud extends Crud
                     $comments[$i]['updated_at_display'] = date($date_format, strtotime($item['updated_at']));
                 }
                 if (isset($item['comment_body']) and ($item['comment_body'] != '')) {
                     $surl = site_url();
                     $item['comment_body'] = str_replace('{SITE_URL}', $surl, $item['comment_body']);
-                    $comments[$i]['comment_body'] = $item['comment_body']; // mw()->format->autolink($item['comment_body']);
+                    $comments[$i]['comment_body'] = htmlentities($item['comment_body']);
                 }
 
                 if (isset($params['single'])) {
 
                     return $comments;
diff --git a/src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php b/src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php
index c0816e66df..28c16a3ea4 100644
--- a/src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php
+++ b/src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php
@@ -53,14 +53,14 @@
                             </span>
                             <small class="text-muted">says:</small>
                         </h6>
 
                     <div class="mb-3">
-                        <div class="js-comment-body-text"><?php print $comment['comment_body']; ?></div>
+                        <div class="js-comment-body-text">{{ $comment['comment_body'] }}</div>
                         <span class="js-comment-body-textarea" style="display: none;">
                             <small class="text-muted">Comment:</small>
-                            <textarea name="comment_body" class="form-control"><?php print $comment['comment_body']; ?></textarea>
+                            <textarea name="comment_body" class="form-control">{{ $comment['comment_body'] }}</textarea>
                         </span>
                     </div>
 
                     <div class="mb-3">
                         <?php if ($comment['comment_email']) { ?>
diff --git a/userfiles/modules/comments/src/Controllers/Admin.php b/userfiles/modules/comments/src/Controllers/Admin.php
index 054aa11315..fbf5f1d2de 100644
--- a/userfiles/modules/comments/src/Controllers/Admin.php
+++ b/userfiles/modules/comments/src/Controllers/Admin.php
@@ -44,11 +44,10 @@ class Admin
     }
 
 
     function comments_list($params)
     {
-
         if (!user_can_access('module.comments.index')) {
             return;
         }
 
         if (!isset($params['content_id'])) {
@@ -111,16 +110,14 @@ class Admin
             'single' => true,
         );
 
         $comment = get_comments($data);
 
-
         if (!$comment) {
             return;
         }
 
-
         $view_file = $this->views_dir . 'comment_item.php';
         $view = new View($view_file);
         $view->assign('params', $params);
         $view->assign('comment', $comment);
 

Vulnerable code:                     $comments[$i]['comment_body'] = $item['comment_body']; // mw()->format->autolink($item['comment_body']);
                        <div class="js-comment-body-text"><?php print $comment['comment_body']; ?></div>
                            <textarea name="comment_body" class="form-control"><?php print $comment['comment_body']; ?></textarea>



Fixed code: 
                    $comments[$i]['comment_body'] = htmlentities($item['comment_body']);
                        <div class="js-comment-body-text">{{ $comment['comment_body'] }}</div>
                            <textarea name="comment_body" class="form-control">{{ $comment['comment_body'] }}</textarea>