CVE-2022-1719: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-29T03:15Z
Repository: https://github.com/polonel/trudesk
Language: JavaScript
Files changed: src/controllers/tickets.js, src/helpers/utils/index.js
Commit date: 2022-05-14 16:11:35 -0400
Commit message: fix(tickets): security fix
Diff: diff --git a/src/controllers/tickets.js b/src/controllers/tickets.js
index db1cdb6c..c88f5c79 100644
--- a/src/controllers/tickets.js
+++ b/src/controllers/tickets.js
@@ -231,20 +231,26 @@ ticketsController.filter = function (req, res, next) {
   let tags = queryString.tag
   let assignee = queryString.au
 
   const rawNoPage = req.originalUrl.replace(/[?&]page=[^&#]*(#.*)?$/, '$1').replace(/([?&])page=[^&]*&/, '$1')
 
+  if (!_.isUndefined(status)) status = xss(status)
   if (!_.isUndefined(status) && !_.isArray(status)) status = [status]
+  if (!_.isUndefined(priority)) priority = xss(priority)
   if (!_.isUndefined(priority) && !_.isArray(priority)) priority = [priority]
+  if (!_.isUndefined(groups)) groups = xss(groups)
   if (!_.isUndefined(groups) && !_.isArray(groups)) groups = [groups]
+  if (!_.isUndefined(types)) types = xss(types)
   if (!_.isUndefined(types) && !_.isArray(types)) types = [types]
+  if (!_.isUndefined(tags)) tags = xss(tags)
   if (!_.isUndefined(tags) && !_.isArray(tags)) tags = [tags]
+  if (!_.isUndefined(assignee)) assignee = xss(assignee)
   if (!_.isUndefined(assignee) && !_.isArray(assignee)) assignee = [assignee]
 
   const filter = {
     uid: uid,
-    subject: subject,
+    subject: xss(subject),
     issue: issue,
     date: {
       start: dateStart,
       end: dateEnd
     },
diff --git a/src/helpers/utils/index.js b/src/helpers/utils/index.js
index da0c6f4e..adaab761 100644
--- a/src/helpers/utils/index.js
+++ b/src/helpers/utils/index.js
@@ -18,10 +18,14 @@ const fs = require('fs')
 const piexifjs = require('piexifjs')
 
 const MAX_FIELD_TEXT_LENGTH = 255
 const MAX_SHORT_FIELD_TEXT_LENGTH = 25
 
+module.exports.applyMaxTextLength = function (text) {
+  return text.toString().substring(0, MAX_FIELD_TEXT_LENGTH)
+}
+
 module.exports.applyMaxShortTextLength = function (text) {
   return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
 }
 
 module.exports.sanitizeFieldPlainText = function (text) {

Vulnerable code:     subject: subject,
Fixed code:   if (!_.isUndefined(status)) status = xss(status)
  if (!_.isUndefined(priority)) priority = xss(priority)
  if (!_.isUndefined(groups)) groups = xss(groups)
  if (!_.isUndefined(types)) types = xss(types)
  if (!_.isUndefined(tags)) tags = xss(tags)
  if (!_.isUndefined(assignee)) assignee = xss(assignee)
    subject: xss(subject),
module.exports.applyMaxTextLength = function (text) {
  return text.toString().substring(0, MAX_FIELD_TEXT_LENGTH)
}