CVE-2022-1718: Integer Overflow or Wraparound (CWE-190)
value: The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2022-09-29T03:15Z
Repository: https://github.com/polonel/trudesk
Language: JavaScript
Files changed: src/helpers/utils/index.js, src/models/user.js
Commit date: 2022-05-14 15:39:02 -0400
Commit message: fix(account): security fix
Diff: diff --git a/src/helpers/utils/index.js b/src/helpers/utils/index.js
index d5e54253..da0c6f4e 100644
--- a/src/helpers/utils/index.js
+++ b/src/helpers/utils/index.js
@@ -15,10 +15,17 @@
 const _ = require('lodash')
 const xss = require('xss')
 const fs = require('fs')
 const piexifjs = require('piexifjs')
 
+const MAX_FIELD_TEXT_LENGTH = 255
+const MAX_SHORT_FIELD_TEXT_LENGTH = 25
+
+module.exports.applyMaxShortTextLength = function (text) {
+  return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
+}
+
 module.exports.sanitizeFieldPlainText = function (text) {
   return xss(text, {
     whileList: {},
     stripIgnoreTag: true,
     stripIgnoreTagBody: ['script']
diff --git a/src/models/user.js b/src/models/user.js
index 894e681a..5132b847 100644
--- a/src/models/user.js
+++ b/src/models/user.js
@@ -88,15 +88,15 @@ var autoPopulateRole = function (next) {
 userSchema.pre('findOne', autoPopulateRole).pre('find', autoPopulateRole)
 
 userSchema.pre('save', function (next) {
   var user = this
 
-  user.username = utils.sanitizeFieldPlainText(user.username.toLowerCase().trim())
+  user.username = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.username.toLowerCase().trim()))
   user.email = utils.sanitizeFieldPlainText(user.email.trim())
 
-  if (user.fullname) user.fullname = utils.sanitizeFieldPlainText(user.fullname.trim())
-  if (user.title) user.title = utils.sanitizeFieldPlainText(user.title.trim())
+  if (user.fullname) user.fullname = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.fullname.trim()))
+  if (user.title) user.title = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.title.trim()))
 
   if (!user.isModified('password')) {
     return next()
   }
 

Vulnerable code:   user.username = utils.sanitizeFieldPlainText(user.username.toLowerCase().trim())
  if (user.fullname) user.fullname = utils.sanitizeFieldPlainText(user.fullname.trim())
  if (user.title) user.title = utils.sanitizeFieldPlainText(user.title.trim())
Fixed code: const MAX_FIELD_TEXT_LENGTH = 255
const MAX_SHORT_FIELD_TEXT_LENGTH = 25

module.exports.applyMaxShortTextLength = function (text) {
  return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
}

  user.username = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.username.toLowerCase().trim()))
  if (user.fullname) user.fullname = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.fullname.trim()))
  if (user.title) user.title = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.title.trim()))