CVE-2022-4736: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-25T20:15Z
Repository: https://github.com/jschwindt/Venganzas-del-Pasado
Language: Ruby
Files changed: .nvmrc, app/views/posts/archive.html.erb, app/views/posts/contributions.html.erb, app/views/posts/index.html.erb, app/views/torrents/index.html.erb
Commit date: 2022-10-30 12:57:15 -0300
Commit message: Remove 'raw' to fix XSS

See: https://www.openbugbounty.org/reports/3022583/

Diff: diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..51b24dc
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+v12.22.10
diff --git a/app/views/posts/archive.html.erb b/app/views/posts/archive.html.erb
index 7e531a1..9fc45bc 100644
--- a/app/views/posts/archive.html.erb
+++ b/app/views/posts/archive.html.erb
@@ -6,13 +6,13 @@
   <% title_part = "Archivo de programas del año #{params[:year]}" -%>
 <% end %>
 <% if params[:page].nil? %>
   <% the_title = title_part %>
 <% else %>
-  <% the_title = "#{title_part}, <small>Página #{params[:page]}</small>" %>
+  <% the_title = "#{title_part} (página #{params[:page]})" -%>
 <% end %>
 <% page_title the_title %>
 <% meta_description strip_tags("#{the_title} de La Venganza será Terrible") %>
-<h2 class="title fancy is-4"><%= raw the_title %></h2>
+<h2 class="title fancy is-4"><%= the_title %></h2>
 <%= render 'layouts/banners/top' %>
 <%= render @posts %>
 <%= paginate @posts, window: 2 %>
diff --git a/app/views/posts/contributions.html.erb b/app/views/posts/contributions.html.erb
index 19600dd..e7b2425 100644
--- a/app/views/posts/contributions.html.erb
+++ b/app/views/posts/contributions.html.erb
@@ -1,11 +1,11 @@
 <% if params[:page].nil? %>
   <% the_title = "Contribuciones de Programas de La Venganza será Terrible" -%>
 <% else %>
-  <% the_title = "Contribuciones de Programas de La Venganza será Terrible, <small>Página #{params[:page]}</small>" -%>
+  <% the_title = "Contribuciones de Programas de La Venganza será Terrible (página #{params[:page]})" -%>
 <% end %>
 <% page_title the_title -%>
 <% meta_description strip_tags(the_title) -%>
-<h2 class="title fancy is-4"><%= raw the_title %></h2>
+<h2 class="title fancy is-4"><%= the_title %></h2>
 <%= render 'layouts/banners/top' %>
 <%= render @posts %>
 <%= paginate @posts, window: 2 %>
diff --git a/app/views/posts/index.html.erb b/app/views/posts/index.html.erb
index 96f88d6..5f15f71 100644
--- a/app/views/posts/index.html.erb
+++ b/app/views/posts/index.html.erb
@@ -1,11 +1,11 @@
 <% if params[:page].present? %>
-  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina, <small>Página #{params[:page]}</small>" -%>
+  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
 <% else %>
   <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina" -%>
 <% end %>
 <% page_title the_title -%>
 <% meta_description strip_tags(the_title) -%>
-<h2 class="title fancy is-4"><%= raw the_title %></h2>
+<h2 class="title fancy is-4"><%= the_title %></h2>
 <%= render 'layouts/banners/top' %>
 <%= render @posts %>
 <%= paginate @posts, window: 2 %>
diff --git a/app/views/torrents/index.html.erb b/app/views/torrents/index.html.erb
index fab30f4..4e9b5a3 100644
--- a/app/views/torrents/index.html.erb
+++ b/app/views/torrents/index.html.erb
@@ -1,14 +1,14 @@
 <% if params[:page].nil? %>
   <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina" -%>
 <% else %>
-  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina<small>, Página #{params[:page]}</small>" -%>
+  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
 <% end %>
 <% page_title the_title -%>
 <% meta_description strip_tags(the_title) -%>
 <h2 class="title fancy is-4">Descarga de los MP3 usando torrent</h2>
-<h2 class="title"><%=raw the_title %></h2>
+<h2 class="title"><%= the_title %></h2>
 <div class="content">
   Si estás usando el RSS de los torrents para agregarlo a tu cliente
   BitTorrent favorito y automatizar las descargas,
   <%= link_to "usá este link", torrents_url(:format => :rss) %>.
 </div>

Vulnerable code:   <% the_title = "#{title_part}, <small>Página #{params[:page]}</small>" %>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Contribuciones de Programas de La Venganza será Terrible, <small>Página #{params[:page]}</small>" -%>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina, <small>Página #{params[:page]}</small>" -%>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina<small>, Página #{params[:page]}</small>" -%>
<h2 class="title"><%=raw the_title %></h2>
Fixed code: v12.22.10
  <% the_title = "#{title_part} (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Contribuciones de Programas de La Venganza será Terrible (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
<h2 class="title"><%= the_title %></h2>