CVE-2022-0913: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2022-03-11T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
Commit date: 2022-03-11 10:30:42 +0200
Commit message: checkout shipping address validation - max chars allowed

Diff: diff --git a/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php b/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
index 1d71607f86ea..b6eaecd77865 100644
--- a/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
+++ b/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
@@ -36,17 +36,34 @@ trait ShippingTrait {
 
     public function shippingMethodSave(Request $request) {
 
         if (is_array($request->get('Address'))) {
             $request->merge([
-               'city'=>$request->get('Address')['city'],
-               'zip'=>$request->get('Address')['zip'],
-               'state'=>$request->get('Address')['state'],
-               'address'=>$request->get('Address')['address'],
+                'city'=>$request->get('Address')['city'],
+                'zip'=>$request->get('Address')['zip'],
+                'state'=>$request->get('Address')['state'],
+                'address'=>$request->get('Address')['address'],
             ]);
         }
 
+        $rules = [];
+        $rules['shipping_gw'] = 'max:500';
+        $rules['city'] = 'max:500';
+        $rules['address'] = 'max:500';
+        $rules['country'] = 'max:500';
+        $rules['state'] = 'max:500';
+        $rules['zip'] = 'max:500';
+        $rules['other_info'] = 'max:500';
+
+        $validator = Validator::make($request->all(), $rules);
+
+        if ($validator->fails()) {
+            $errors = $validator->messages()->toArray();
+            session_set('errors', $errors);
+            return redirect(route('checkout.shipping_method'));
+        }
+
         session_append_array('checkout_v2', [
             'shipping_gw'=> $request->get('shipping_gw'),
             'city'=> $request->get('city'),
             'address'=> $request->get('address'),
             'country'=> $request->get('country'),

Vulnerable code:                'city'=>$request->get('Address')['city'],
               'zip'=>$request->get('Address')['zip'],
               'state'=>$request->get('Address')['state'],
               'address'=>$request->get('Address')['address'],
Fixed code:                 'city'=>$request->get('Address')['city'],
                'zip'=>$request->get('Address')['zip'],
                'state'=>$request->get('Address')['state'],
                'address'=>$request->get('Address')['address'],
        $rules = [];
        $rules['shipping_gw'] = 'max:500';
        $rules['city'] = 'max:500';
        $rules['address'] = 'max:500';
        $rules['country'] = 'max:500';
        $rules['state'] = 'max:500';
        $rules['zip'] = 'max:500';
        $rules['other_info'] = 'max:500';

        $validator = Validator::make($request->all(), $rules);

        if ($validator->fails()) {
            $errors = $validator->messages()->toArray();
            session_set('errors', $errors);
            return redirect(route('checkout.shipping_method'));
        }