CVE-2012-4267: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-08-13T22:55Z
Repository: https://github.com/rodnaph/sockso
Language: Other
Files changed: templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon, templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
Commit date: 2012-05-08 22:54:22 +0100
Commit message: added fixed for XSS holes (fixes #93)

Diff: diff --git a/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon b/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon
index 9241cb2..1704ee7 100644
--- a/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon
+++ b/templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon
@@ -21,15 +21,15 @@
     User user = null;
     Locale locale = null;
     Vector<User> recentUsers = null;
 </%args>
 
-<& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>
+<& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>
 
 <h2>
     <div class="links">
-        <% Utils.u2e(playlist.getName()) #n %>
+        <% Utils.XMLEncode(playlist.getName()) #n %>
         <div class="links">
             <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); shareLink=true; playRandomLink=true; locale=locale; properties=properties; &>
         </div>
     </div>
 </h2>
diff --git a/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon b/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
index fb31b74..f894978 100644
--- a/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
+++ b/templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
@@ -51,16 +51,16 @@
     <ul id="userPlaylists" class="musiclist">
     <%if userPlaylists.size() > 0 %>
         <%for Playlist playlist : userPlaylists %>
             <li class="playlist" id="userPlaylist<% playlist.getId() %>">
                 <& IMusicLinks; type="pl"; id=playlist.getId(); name=playlist.getName(); locale=locale; properties=properties; &>
-                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.u2e(playlist.getName()) #n %></a>
+                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.XMLEncode(playlist.getName()) #n %></a>
                 by
                 <%if user != null && (user.getId() == playlist.getUser().getId()) %>
                     <b>you</b>
                 <%else>
-                    <% Utils.u2e(playlist.getUser().getName()) #n %>
+                    <% Utils.XMLEncode(playlist.getUser().getName()) #n %>
                 </%if>
                 (<% playlist.getTrackCount() %> track<%if playlist.getTrackCount() != 1 %>s</%if>)
                 <%if user != null && (playlist.getUser().getId() == user.getId()) %>
                     <a href="javascript:;" class="delete" onclick="deletePlaylist('<% playlist.getId() %>');return false;"><img
                         src="<% properties.getUrl("/<skin>/images/remove.png") #n %>" title="<% locale.getString("www.label.deletePlaylist") %>" /></a>

Vulnerable code: <& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>
        <% Utils.u2e(playlist.getName()) #n %>
                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.u2e(playlist.getName()) #n %></a>
                    <% Utils.u2e(playlist.getUser().getName()) #n %>
Fixed code: <& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>
        <% Utils.XMLEncode(playlist.getName()) #n %>
                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.XMLEncode(playlist.getName()) #n %></a>
                    <% Utils.XMLEncode(playlist.getUser().getName()) #n %>