CVE-2015-5282: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-25T17:29Z
Repository: https://github.com/theforeman/foreman
Language: JavaScript
Files changed: app/assets/javascripts/hidden_values.js
Commit date: 2015-09-21 10:38:21 +0100
Commit message: Fixes #11859 - handle HTML in parameters safely when hiding values (CVE-2015-5282)

Diff: diff --git a/app/assets/javascripts/hidden_values.js b/app/assets/javascripts/hidden_values.js
index 818d07a29..14cff054f 100644
--- a/app/assets/javascripts/hidden_values.js
+++ b/app/assets/javascripts/hidden_values.js
@@ -3,24 +3,24 @@ function turn_textarea_switch(checkbox) {
   var id = checkbox.id.replace(/hidden_value$/, "value");
   var source = document.getElementById(id);
   var $editorContainer = $('.editor-container');
 
   if (checkbox.checked) {
-    target = '<input class="form-control" type="password" id="' + id + '" name="' + source.name + '" value ="' + source.value + '"></input>'
+    target = $('<input/>').attr({ type: 'password', id: id, name: source.name, value: $(source).val(), class: 'form-control'});
     $editorContainer.find('.navbar').hide();
     $editorContainer.find('.ace_editor').remove();
     $(source).replaceWith(target);
   } else if ($('.editor-container').length > 0) {
-    target = '<textarea class="form-control editor_source hide" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
+    target = $('<textarea/>').attr({class: 'form-control editor_source hide', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});
     $editorContainer.find('.navbar').show();
     $(source).replaceWith(target);
 
     onEditorLoad();
     session = Editor.getSession();
     session.setValue($(source).val());
   } else {
-    var target = '<textarea class="form-control" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
+    var target = $('<textarea/>').attr({class: 'form-control', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});
     $(source).replaceWith(target);
   }
 }
 function hidden_value_control(){
   $(".toggle-hidden-value a").click(function(event){

Vulnerable code:     target = '<input class="form-control" type="password" id="' + id + '" name="' + source.name + '" value ="' + source.value + '"></input>'
    target = '<textarea class="form-control editor_source hide" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
    var target = '<textarea class="form-control" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
Fixed code:     target = $('<input/>').attr({ type: 'password', id: id, name: source.name, value: $(source).val(), class: 'form-control'});
    target = $('<textarea/>').attr({class: 'form-control editor_source hide', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});
    var target = $('<textarea/>').attr({class: 'form-control', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});