CVE-2018-25064: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named 4bed3b34dcc01fe6661f39c0e5d2285b340f7cac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217439.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-05T09:15Z
Repository: https://github.com/osmlab/show-me-the-way
Language: JavaScript
Files changed: index.html, js/site.js
Commit date: 2018-02-19 10:09:41 +0000
Commit message: Fix some XSS issues

Since OSM data, changeset comments and potentially even OSM usernames may
contain HTML code, it's better to use the textContent property to insert
such values, since innerHTML would result in interpretation of this HTML
code which might even result in the execution of JavaScript code [1].
The Underscore.js template is also affected by such issues, which can be
mitigated by using <%- instead of <%= for interpolations [2].

[1] https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML#Security_considerations
[2] http://underscorejs.org/#template

Diff: diff --git a/index.html b/index.html
index 785da25..8667950 100644
--- a/index.html
+++ b/index.html
@@ -24,12 +24,12 @@
     <div id='map' class='col12 full-height'></div>
     <a href='http://openstreetmap.org/' class='byosm'></a>
 </div>
     <script id='changeset-template' type='template'>
 <% var past_tense = { modify: 'modified', create: 'created', 'delete': 'deleted' }; %>
-<p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%=change.meta.changeset%>'><%=change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%= change.meta.user %>'><%= change.meta.user %></a>
-     <%= past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%= change.meta.type %>/<%= change.meta.id %>'><%= change.tagtext %></a>
+<p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%-change.meta.changeset%>'><%-change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%- change.meta.user %>'><%- change.meta.user %></a>
+     <%- past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%- change.meta.type %>/<%- change.meta.id %>'><%- change.tagtext %></a>
     </p>
     </script>
     <script src='//cdnjs.cloudflare.com/ajax/libs/leaflet/0.5/leaflet.js'></script>
     <script src='js/Bing.js'></script>
     <script src='js/bundle.js'></script>
diff --git a/js/site.js b/js/site.js
index 888cdba..2c56f66 100644
--- a/js/site.js
+++ b/js/site.js
@@ -113,11 +113,11 @@ function showLocation(ll) {
     reqwest({
         url: nominatim_tmpl.replace('{lat}', ll.lat).replace('{lon}', ll.lng),
         crossOrigin: true,
         type: 'json'
     }, function(resp) {
-        document.getElementById('reverse-location').innerHTML =
+        document.getElementById('reverse-location').textContent =
             '' + resp.display_name + '';
     });
 }
 
 function fetchChangesetData(id, callback) {
@@ -145,11 +145,11 @@ function fetchChangesetData(id, callback) {
     }
 }
 
 function showComment(id) {
     fetchChangesetData(id, function(err, changeset_data) {
-        document.getElementById('comment').innerHTML = changeset_data.comment + ' in ' + changeset_data.created_by;
+        document.getElementById('comment').textContent = changeset_data.comment + ' in ' + changeset_data.created_by;
     });
 }
 
 function makeBbox(bounds_array) {
     return new L.LatLngBounds(
@@ -184,11 +184,11 @@ osmStream.runFn(function(err, data) {
     // if (queue.length > 2000) queue = queue.slice(0, 2000);
     runSpeed = 1500;
 }, null, null, bboxString);
 
 function doDrawWay() {
-    document.getElementById('queuesize').innerHTML = queue.length;
+    document.getElementById('queuesize').textContent = queue.length;
     if (queue.length) {
         var change = queue.pop();
         var way = change.neu || change.old;
 
         // Skip ways that are part of a changeset we don't care about

Vulnerable code: <p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%=change.meta.changeset%>'><%=change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%= change.meta.user %>'><%= change.meta.user %></a>
     <%= past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%= change.meta.type %>/<%= change.meta.id %>'><%= change.tagtext %></a>
        document.getElementById('reverse-location').innerHTML =
        document.getElementById('comment').innerHTML = changeset_data.comment + ' in ' + changeset_data.created_by;
    document.getElementById('queuesize').innerHTML = queue.length;
Fixed code: <p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%-change.meta.changeset%>'><%-change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%- change.meta.user %>'><%- change.meta.user %></a>
     <%- past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%- change.meta.type %>/<%- change.meta.id %>'><%- change.tagtext %></a>
        document.getElementById('reverse-location').textContent =
        document.getElementById('comment').textContent = changeset_data.comment + ' in ' + changeset_data.created_by;
    document.getElementById('queuesize').textContent = queue.length;