CVE-2023-27130: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-16T15:15Z
Repository: https://github.com/typecho/typecho
Language: PHP
Files changed: var/Widget/Archive.php, var/Widget/Menu.php
Commit date: 2023-02-21 17:43:20 +0800
Commit message: fix #1535

Diff: diff --git a/var/Widget/Archive.php b/var/Widget/Archive.php
index 27116a4..1ee9d39 100644
--- a/var/Widget/Archive.php
+++ b/var/Widget/Archive.php
@@ -644,11 +644,11 @@ class Archive extends Contents
             'search_page'        => 'searchHandle'
         ];
 
         /** 处理搜索结果跳转 */
         if (isset($this->request->s)) {
-            $filterKeywords = $this->request->filter('search')->s;
+            $filterKeywords = $this->request->filter('search')->get('s');
 
             /** 跳转到搜索页 */
             if (null != $filterKeywords) {
                 $this->response->redirect(
                     Router::url('search', ['keywords' => urlencode($filterKeywords)], $this->options->index)
diff --git a/var/Widget/Menu.php b/var/Widget/Menu.php
index faf0ab2..e12d623 100644
--- a/var/Widget/Menu.php
+++ b/var/Widget/Menu.php
@@ -125,14 +125,14 @@ class Menu extends Base
 
         /** 获取扩展菜单 */
         $panelTable = unserialize($this->options->panelTable);
         $extendingParentMenu = empty($panelTable['parent']) ? [] : $panelTable['parent'];
         $extendingChildMenu = empty($panelTable['child']) ? [] : $panelTable['child'];
-        $currentUrl = $this->request->makeUriByRequest();
+        $currentUrl = $this->request->getRequestUrl();
         $adminUrl = $this->options->adminUrl;
         $menu = [];
-        $defaultChildeNode = [null, null, null, 'administrator', false, null];
+        $defaultChildNode = [null, null, null, 'administrator', false, null];
 
         $currentUrlParts = parse_url($currentUrl);
         $currentUrlParams = [];
         if (!empty($currentUrlParts['query'])) {
             parse_str($currentUrlParts['query'], $currentUrlParams);
@@ -156,11 +156,11 @@ class Menu extends Base
             $showedChildrenCount = 0;
             $firstUrl = null;
 
             foreach ($childNodes[$key] as $inKey => $childNode) {
                 // magic merge
-                $childNode += $defaultChildeNode;
+                $childNode += $defaultChildNode;
                 [$name, $title, $url, $access] = $childNode;
 
                 $hidden = $childNode[4] ?? false;
                 $addLink = $childNode[5] ?? null;
 
@@ -253,11 +253,11 @@ class Menu extends Base
 
             $menu[$key] = [$parentNode, $showedChildrenCount > 0, $firstUrl, $children];
         }
 
         $this->menu = $menu;
-        $this->currentUrl = $currentUrl;
+        $this->currentUrl = Common::safeUrl($currentUrl);
     }
 
     /**
      * 获取当前菜单
      *

Vulnerable code:             $filterKeywords = $this->request->filter('search')->s;
        $currentUrl = $this->request->makeUriByRequest();
        $defaultChildeNode = [null, null, null, 'administrator', false, null];
                $childNode += $defaultChildeNode;
        $this->currentUrl = $currentUrl;
Fixed code:             $filterKeywords = $this->request->filter('search')->get('s');
        $currentUrl = $this->request->getRequestUrl();
        $defaultChildNode = [null, null, null, 'administrator', false, null];
                $childNode += $defaultChildNode;
        $this->currentUrl = Common::safeUrl($currentUrl);