CVE-2012-4396: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-05T23:55Z
Repository: https://github.com/owncloud/core
Language: JavaScript
Files changed: core/js/multiselect.js
Commit date: 2012-06-09 15:08:05 +0200
Commit message: fix potential xss in multiselect

Diff: diff --git a/core/js/multiselect.js b/core/js/multiselect.js
index 541dddf0f..5f339006d 100644
--- a/core/js/multiselect.js
+++ b/core/js/multiselect.js
@@ -55,12 +55,15 @@
 			var list=$('<ul class="multiselectoptions"/>').hide().appendTo($(this).parent());
 			function createItem(element,checked){
 				element=$(element);
 				var item=element.val();
 				var id='ms'+multiSelectId+'-option-'+item;
-				var input=$('<input id="'+id+'" type="checkbox"/>');
-				var label=$('<label for="'+id+'">'+item+'</label>');
+				var input=$('<input type="checkbox"/>');
+				input.attr('id',id);
+				var label=$('<label/>');
+				label.attr('for',id);
+				label.text(item);
 				if(settings.checked.indexOf(item)!=-1 || checked){
 					input.attr('checked',true);
 				}
 				if(checked){
 					settings.checked.push(item);
@@ -128,11 +131,14 @@
 							var li=$(this).parent();
 							$(this).remove();
 							li.text('+ '+settings.createText);
 							li.before(createItem(this));
 							var select=button.parent().next();
-							select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));
+							var option=$('<option selected="selected"/>');
+							option.attr('value',$(this).val());
+							option.text($(this).val());
+							select.append(optione);
 							li.prev().children('input').trigger('click');
 							button.parent().data('preventHide',false);
 							if(settings.createCallback){
 								settings.createCallback();
 							}

Vulnerable code: 				var input=$('<input id="'+id+'" type="checkbox"/>');
				var label=$('<label for="'+id+'">'+item+'</label>');
							select.append($('<option selected="selected" value="'+$(this).val()+'">'+$(this).val()+'</option>'));
Fixed code: 				var input=$('<input type="checkbox"/>');
				input.attr('id',id);
				var label=$('<label/>');
				label.attr('for',id);
				label.text(item);
							var option=$('<option selected="selected"/>');
							option.attr('value',$(this).val());
							option.text($(this).val());
							select.append(optione);