CVE-2022-1926: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 4.9
Published: 2022-05-31T09:15Z
Repository: https://github.com/polonel/trudesk
Language: JavaScript
Files changed: src/helpers/utils/index.js, src/models/chat/message.js
Commit date: 2022-05-28 03:01:44 -0400
Commit message: fix(messages): xss security
Diff: diff --git a/src/helpers/utils/index.js b/src/helpers/utils/index.js
index adaab761f..577fb2f16 100644
--- a/src/helpers/utils/index.js
+++ b/src/helpers/utils/index.js
@@ -17,19 +17,24 @@ const xss = require('xss')
 const fs = require('fs')
 const piexifjs = require('piexifjs')
 
 const MAX_FIELD_TEXT_LENGTH = 255
 const MAX_SHORT_FIELD_TEXT_LENGTH = 25
+const MAX_EXTREME_TEXT_LENGTH = 2000
 
 module.exports.applyMaxTextLength = function (text) {
   return text.toString().substring(0, MAX_FIELD_TEXT_LENGTH)
 }
 
 module.exports.applyMaxShortTextLength = function (text) {
   return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
 }
 
+module.exports.applyExtremeTextLength = function (text) {
+  return text.toString().substring(0, MAX_EXTREME_TEXT_LENGTH)
+}
+
 module.exports.sanitizeFieldPlainText = function (text) {
   return xss(text, {
     whileList: {},
     stripIgnoreTag: true,
     stripIgnoreTagBody: ['script']
diff --git a/src/models/chat/message.js b/src/models/chat/message.js
index f0953d78a..e788bc8d7 100644
--- a/src/models/chat/message.js
+++ b/src/models/chat/message.js
@@ -10,16 +10,17 @@
  *  Author:     Chris Brame
  *  Updated:    1/21/19 2:04 AM
  *  Copyright (c) 2014-2019. All rights reserved.
  */
 
-var mongoose = require('mongoose')
-var _ = require('lodash')
+const mongoose = require('mongoose')
+const _ = require('lodash')
+const utils = require('../../helpers/utils')
 
-var COLLECTION = 'messages'
+const COLLECTION = 'messages'
 
-var messageSchema = mongoose.Schema(
+const messageSchema = mongoose.Schema(
   {
     conversation: {
       type: mongoose.Schema.Types.ObjectId,
       required: true,
       index: true
@@ -33,10 +34,16 @@ var messageSchema = mongoose.Schema(
     body: { type: String, required: true }
   },
   { timestamps: true }
 )
 
+messageSchema.pre('save', function (next) {
+  this.body = utils.sanitizeFieldPlainText(utils.applyExtremeTextLength(this.body))
+
+  next()
+})
+
 messageSchema.statics.getFullConversation = function (convoId, callback) {
   return this.model(COLLECTION)
     .find({ conversation: convoId })
     .select('createdAt body owner')
     .sort('-createdAt')
@@ -63,26 +70,26 @@ messageSchema.statics.getConversation = function (convoId, callback) {
 messageSchema.statics.getConversationWithObject = function (object, callback) {
   if (!_.isObject(object)) {
     return callback('Invalid Object (Must by of type Object) - MessageSchema.GetUserWithObject()', null)
   }
 
-  var self = this
-  var deletedAt = null
+  const self = this
+  let deletedAt = null
 
-  var limit = object.limit === null ? 25 : object.limit
-  var page = object.page === null ? 0 : object.page
+  const limit = object.limit === null ? 25 : object.limit
+  const page = object.page === null ? 0 : object.page
 
   if (object.requestingUser) {
-    var userMetaIdx = _.findIndex(object.userMeta, function (item) {
+    const userMetaIdx = _.findIndex(object.userMeta, function (item) {
       return item.userId.toString() === object.requestingUser._id.toString()
     })
     if (userMetaIdx !== -1 && object.userMeta[userMetaIdx].deletedAt) {
       deletedAt = new Date(object.userMeta[userMetaIdx].deletedAt)
     }
   }
 
-  var q = self
+  const q = self
     .model(COLLECTION)
     .find({})
     .sort('-createdAt')
     .skip(page * limit)
     .populate({

Vulnerable code: var mongoose = require('mongoose')
var _ = require('lodash')
var COLLECTION = 'messages'
var messageSchema = mongoose.Schema(
  var self = this
  var deletedAt = null
  var limit = object.limit === null ? 25 : object.limit
  var page = object.page === null ? 0 : object.page
    var userMetaIdx = _.findIndex(object.userMeta, function (item) {
  var q = self
Fixed code: const MAX_EXTREME_TEXT_LENGTH = 2000
module.exports.applyExtremeTextLength = function (text) {
  return text.toString().substring(0, MAX_EXTREME_TEXT_LENGTH)
}

const mongoose = require('mongoose')
const _ = require('lodash')
const utils = require('../../helpers/utils')
const COLLECTION = 'messages'
const messageSchema = mongoose.Schema(
messageSchema.pre('save', function (next) {
  this.body = utils.sanitizeFieldPlainText(utils.applyExtremeTextLength(this.body))

  next()
})

  const self = this
  let deletedAt = null
  const limit = object.limit === null ? 25 : object.limit
  const page = object.page === null ? 0 : object.page
    const userMetaIdx = _.findIndex(object.userMeta, function (item) {
  const q = self