CVE-2022-1698: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.5
Published: 2022-05-12T16:15Z
Repository: https://github.com/causefx/organizr
Language: PHP
Files changed: api/classes/organizr.class.php
Commit date: 2022-05-11 13:51:55 -0700
Commit message: fix more lengths of user inputs

Diff: diff --git a/api/classes/organizr.class.php b/api/classes/organizr.class.php
index 97883399..e802000d 100644
--- a/api/classes/organizr.class.php
+++ b/api/classes/organizr.class.php
@@ -5110,10 +5110,13 @@ class Organizr
 			$array['name'] = $this->sanitizeUserString($array['name']);
 			if ($this->isTabNameTaken($array['name'])) {
 				$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['name'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Tab name was not supplied', 422);
 			return false;
 		}
 		if (!array_key_exists('url', $array) && !array_key_exists('url_local', $array)) {
@@ -5160,10 +5163,13 @@ class Organizr
 			$array['name'] = $this->sanitizeUserString($array['name']);
 			if ($this->isTabNameTaken($array['name'], $id)) {
 				$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['name'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('default', $array)) {
 			if ($array['default']) {
 				$this->clearTabDefault();
 			}
@@ -5246,10 +5252,13 @@ class Organizr
 			$array['category'] = $this->sanitizeUserString($array['category']);
 			if ($this->isCategoryNameTaken($array['category'])) {
 				$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['category'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Category name was not supplied', 422);
 			return false;
 		}
 		if (!array_key_exists('image', $array)) {
@@ -5294,10 +5303,13 @@ class Organizr
 			$array['category'] = $this->sanitizeUserString($array['category']);
 			if ($this->isCategoryNameTaken($array['category'], $id)) {
 				$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['category'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('image', $array)) {
 			$array['image'] = $this->sanitizeUserString($array['image']);
 		}
 		if (array_key_exists('default', $array)) {
@@ -6485,10 +6497,13 @@ class Organizr
 			$array['username'] = $this->sanitizeUserString($array['username']);
 			if ($this->usernameTaken($array['username'], $array['username'], $id)) {
 				$this->setAPIResponse('error', 'Username: ' . $array['username'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['username'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('email', $array)) {
 			if ($array['email'] == '') {
 				$this->setAPIResponse('error', 'Email was set but empty', 409);
 				return false;
@@ -6501,10 +6516,13 @@ class Organizr
 			}
 			if ($this->usernameTaken($array['email'], $array['email'], $id)) {
 				$this->setAPIResponse('error', 'Email: ' . $array['email'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['email'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('group_id', $array)) {
 			if ($array['group_id'] == '') {
 				$array['group_id'] = 0;
 				//$this->setAPIResponse('error', 'group_id was set but empty', 409);
@@ -6620,10 +6638,19 @@ class Organizr
 			$email = $this->sanitizeEmail($email);
 		} else {
 			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
 			return false;
 		}
+		if (!$this->qualifyLength($username, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($email, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($password, 200, true)) {
+			return false;
+		}
 		$this->setLoggerChannel('User Management');
 		if ($this->createUser($username, $password, $email)) {
 			$this->logger->info('Account created for [' . $username . ']');
 			return true;
 		} else {
@@ -6658,10 +6685,19 @@ class Organizr
 		}
 		if ($this->usernameTaken($username, $email)) {
 			$this->setAPIResponse('error', 'Username: ' . $username . ' or Email: ' . $email . ' is already taken', 409);
 			return false;
 		}
+		if (!$this->qualifyLength($username, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($email, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($password, 200, true)) {
+			return false;
+		}
 		$defaults = $this->getDefaultGroup();
 		$userInfo = [
 			'username' => $username,
 			'password' => password_hash($password, PASSWORD_BCRYPT),
 			'email' => $email,
@@ -6712,10 +6748,13 @@ class Organizr
 			$array['group'] = $this->sanitizeUserString($array['group']);
 			if ($this->isGroupNameTaken($array['group'], $id)) {
 				$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['group'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('image', $array)) {
 			if ($array['image'] == '') {
 				$this->setAPIResponse('error', 'Image was set but empty', 409);
 				return false;
@@ -6792,10 +6831,13 @@ class Organizr
 			$array['group'] = $this->sanitizeUserString($array['group']);
 			if ($this->isGroupNameTaken($array['group'])) {
 				$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['group'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Group name was not supplied', 422);
 			return false;
 		}
 		if (array_key_exists('image', $array)) {

Fixed code: 			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['username'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['email'], 50, true)) {
				return false;
			}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}