CVE-2013-2023: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-08-15T17:55Z
Repository: https://github.com/happyworm/jPlayer
Language: Other
Files changed: actionscript/Jplayer.as, actionscript/happyworm/jPlayer/JplayerStatus.as, jquery.jplayer/jquery.jplayer.js, package.json
Commit date: 2013-05-14 21:15:51 +0100
Commit message: Security Fix completed for issue #162 ref CVE-2013-2023

Diff: diff --git a/actionscript/Jplayer.as b/actionscript/Jplayer.as
index 4451954..2b96675 100644
--- a/actionscript/Jplayer.as
+++ b/actionscript/Jplayer.as
@@ -6,11 +6,11 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.3.1
+ * Version: 2.3.2
  * Date: 14th May 2013
  *
  * FlashVars expected: (AS3 property of: loaderInfo.parameters)
  *	id: 	(URL Encoded: String) Id of jPlayer instance
  *	vol:	(Number) Sets the initial volume
@@ -221,14 +221,19 @@ package {
 
 				ExternalInterface.call(jQuery, "jPlayerFlashEvent", JplayerEvent.JPLAYER_READY, extractStatusData(commonStatus)); // See JplayerStatus() class for version number.
 			}
 		}
 		private function checkFlashVars(p:Object):void {
-			// Check for direct access. Inspired by mediaelement.js - Also added name to object for non-IE browsers.
+			// Check for direct access. Inspired by mediaelement.js - Also added name to HTML object for non-IE browsers.
 			if(ExternalInterface.objectID != null && ExternalInterface.objectID.toString() != "") {
 				for each (var s:String in p) {
-					if(illegalChar(s) || illegalWord(s)) {
+					if(illegalChar(s)) {
+						securityIssue = true; // Found a security concern.
+					}
+				}
+				if(!securityIssue) {
+					if(jQueryIllegal(p.jQuery)) {
 						securityIssue = true; // Found a security concern.
 					}
 				}
 			} else {
 				securityIssue = true; // Direct access disables the callbacks, which were a security concern.
@@ -237,21 +242,14 @@ package {
 		private function illegalChar(s:String):Boolean {
 			// A whitelist of accepted chars.
 			var validParam:RegExp = /^[-A-Za-z0-9_.]+$/;
 			return !validParam.test(s);
 		}
-		private function illegalWord(s:String):Boolean {
-			// A blacklist of JavaScript commands that are a security concern.
-			var illegals:String = "eval document alert confirm prompt console";
-			if(Boolean(s)) { // Otherwise exception if parameter null.
-				for each (var illegal:String in illegals.split(' ')) {
-					if(s.indexOf(illegal) >= 0) {
-						return true; // Illegal word found
-					}
-				}
-			}
-			return false;
+		private function jQueryIllegal(s:String):Boolean {
+			// Check param contains the term jQuery.
+			var validParam:RegExp = /(jQuery)/;
+			return !validParam.test(s);
 		}
 		// switchType() here
 		private function listenToMp3(active:Boolean):void {
 			if(active) {
 				myMp3Player.addEventListener(JplayerEvent.JPLAYER_ERROR, jPlayerFlashEvent);
diff --git a/actionscript/happyworm/jPlayer/JplayerStatus.as b/actionscript/happyworm/jPlayer/JplayerStatus.as
index 8a312fb..257679c 100644
--- a/actionscript/happyworm/jPlayer/JplayerStatus.as
+++ b/actionscript/happyworm/jPlayer/JplayerStatus.as
@@ -12,11 +12,11 @@
  */
 
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.3.1"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.3.2"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()
 
 		public var src:String;
diff --git a/jquery.jplayer/Jplayer.swf b/jquery.jplayer/Jplayer.swf
index e2c6637..7cd1fdf 100644
Binary files a/jquery.jplayer/Jplayer.swf and b/jquery.jplayer/Jplayer.swf differ
diff --git a/jquery.jplayer/jquery.jplayer.js b/jquery.jplayer/jquery.jplayer.js
index cf22a33..f1d002a 100644
--- a/jquery.jplayer/jquery.jplayer.js
+++ b/jquery.jplayer/jquery.jplayer.js
@@ -6,11 +6,11 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.3.1
+ * Version: 2.3.2
  * Date: 14th May 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
 /*jshint asi:false, bitwise:false, boss:false, browser:true, curly:true, debug:false, eqeqeq:true, eqnull:false, evil:false, forin:false, immed:false, jquery:true, laxbreak:false, newcap:true, noarg:true, noempty:true, nonew:true, onevar:false, passfail:false, plusplus:false, regexp:false, undef:true, sub:false, strict:false, white:false, smarttabs:true */
@@ -452,12 +452,12 @@
 	$.jPlayer.keys(true);
 
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.3.1",
-			needFlash: "2.3.1",
+			script: "2.3.2",
+			needFlash: "2.3.2",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor
 			swfPath: "js", // Path to Jplayer.swf. Can be relative, absolute or server root relative.
 			solution: "html, flash", // Valid solutions: html, flash. Order defines priority. 1st is highest,
diff --git a/package.json b/package.json
index d059fc4..2fbd123 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "jplayer",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "The jQuery HTML5 Audio / Video Library",
   "homepage": "http://www.jplayer.org/",
   "keywords": [
     "audio",
     "video"

Vulnerable code:  * Version: 2.3.1
			// Check for direct access. Inspired by mediaelement.js - Also added name to object for non-IE browsers.
					if(illegalChar(s) || illegalWord(s)) {
		private function illegalWord(s:String):Boolean {
			// A blacklist of JavaScript commands that are a security concern.
			var illegals:String = "eval document alert confirm prompt console";
			if(Boolean(s)) { // Otherwise exception if parameter null.
				for each (var illegal:String in illegals.split(' ')) {
					if(s.indexOf(illegal) >= 0) {
						return true; // Illegal word found
					}
				}
			}
			return false;
		public static const VERSION:String = "2.3.1"; // The version of the Flash jPlayer entity.
 * Version: 2.3.1
			script: "2.3.1",
			needFlash: "2.3.1",
  "version": "2.3.1",
Fixed code:  * Version: 2.3.2
			// Check for direct access. Inspired by mediaelement.js - Also added name to HTML object for non-IE browsers.
					if(illegalChar(s)) {
						securityIssue = true; // Found a security concern.
					}
				}
				if(!securityIssue) {
					if(jQueryIllegal(p.jQuery)) {
		private function jQueryIllegal(s:String):Boolean {
			// Check param contains the term jQuery.
			var validParam:RegExp = /(jQuery)/;
			return !validParam.test(s);
		public static const VERSION:String = "2.3.2"; // The version of the Flash jPlayer entity.
 * Version: 2.3.2
			script: "2.3.2",
			needFlash: "2.3.2",
  "version": "2.3.2",