CVE-2022-4525: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.rc is able to address this issue. The name of the patch is da44a3893b407087829b006d09339780919714cd. It is recommended to upgrade the affected component. The identifier VDB-215905 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T21:15Z
Repository: https://github.com/nsrr/sleepdata.org
Language: Other
Files changed: CHANGELOG.md, app/views/layouts/application.html.haml, app/views/layouts/full_page.html.haml, app/views/layouts/full_page_custom_header.html.haml, app/views/layouts/full_page_no_header.html.haml, app/views/layouts/full_page_sidebar.html.haml
Commit date: 2022-04-23 11:36:42 -0400
Commit message: Fixed a Cross Site Scripting (XSS) issue

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index eea2f151..952b42b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 ## 57.2.0
 
+### Enhancements
+- **Security Changes**
+  - Fixed a Cross Site Scripting (XSS) issue
+
 ## 57.1.0 (April 19, 2022)
 
 ### Enhancements
 - **General Changes**
   - Added Fathom Analytics to website and removed Google Analytics
diff --git a/app/views/layouts/application.html.haml b/app/views/layouts/application.html.haml
index 7db945e7..05cce6d9 100644
--- a/app/views/layouts/application.html.haml
+++ b/app/views/layouts/application.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
+    %title= [@title, ENV["website_name"]].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page.html.haml b/app/views/layouts/full_page.html.haml
index 1bc589dd..b7ea64ad 100644
--- a/app/views/layouts/full_page.html.haml
+++ b/app/views/layouts/full_page.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
+    %title= [@title, ENV["website_name"]].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_custom_header.html.haml b/app/views/layouts/full_page_custom_header.html.haml
index 8cf9fd26..24da329a 100644
--- a/app/views/layouts/full_page_custom_header.html.haml
+++ b/app/views/layouts/full_page_custom_header.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
+    %title= [@title, ENV["website_name"]].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_no_header.html.haml b/app/views/layouts/full_page_no_header.html.haml
index 62bc4a99..a99167cf 100644
--- a/app/views/layouts/full_page_no_header.html.haml
+++ b/app/views/layouts/full_page_no_header.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
+    %title= [@title, ENV["website_name"]].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }
diff --git a/app/views/layouts/full_page_sidebar.html.haml b/app/views/layouts/full_page_sidebar.html.haml
index 9a252189..b3e252db 100644
--- a/app/views/layouts/full_page_sidebar.html.haml
+++ b/app/views/layouts/full_page_sidebar.html.haml
@@ -7,11 +7,11 @@
     = render "layouts/meta/general"
     = render "layouts/meta/facebook"
     = render "layouts/meta/google"
     -# Don't cache any pages
     %meta{ name: "turbolinks-cache-control", content: "no-cache" }
-    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
+    %title= [@title, ENV["website_name"]].compact.join(" - ")
     = favicon_link_tag
     = auto_discovery_link_tag(:rss, "#{ENV["website_url"]}/blog.atom")
     = csrf_meta_tags
     = render "layouts/fathom_analytics" if Rails.env.production?
     = stylesheet_link_tag "application", media: "all", data: { turbolinks_track: "reload" }

Vulnerable code:     %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
Fixed code: ### Enhancements
- **Security Changes**
  - Fixed a Cross Site Scripting (XSS) issue

    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")