CVE-2018-16407: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-09-03T19:29Z
Repository: https://gitlab.com/mayan-edms/mayan-edms
Language: Other
Files changed: HISTORY.rst, mayan/apps/tags/widgets.py
Commit date: 2018-08-17 04:12:00 -0400
Commit message: Add explicit casting of escaped tag labels to prevent exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and proposed solutions. Closes GitLab issue #496.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

Diff: diff --git a/HISTORY.rst b/HISTORY.rst
index ca7371198c..007d11dd82 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -1,5 +1,11 @@
+3.0.3 (2018-08-17)
+==================
+- Add explicit casting of escaped tag labels to prevent exploit
+  of cross site scripting. Thanks to Lokesh (@lokesh1095) for
+  the report and proposed solutions. Closes GitLab issue #496.
+
 3.0.2 (2018-08-16)
 ==================
 - Docker install script: Default to verbose.
 - Docker install script: Increase startup timer to 10 seconds.
 - Docker install script: Allow configuring the PostgreSQL port.
diff --git a/mayan/apps/tags/widgets.py b/mayan/apps/tags/widgets.py
index 449069576c..d532d0e8c1 100644
--- a/mayan/apps/tags/widgets.py
+++ b/mayan/apps/tags/widgets.py
@@ -1,10 +1,11 @@
 from __future__ import absolute_import, unicode_literals
 
 from django import forms
 from django.apps import apps
 from django.template.loader import render_to_string
+from django.utils.html import conditional_escape
 from django.utils.safestring import mark_safe
 
 from .permissions import permission_tag_view
 
 
@@ -15,12 +16,12 @@ class TagFormWidget(forms.SelectMultiple):
         self.queryset = kwargs.pop('queryset')
         return super(TagFormWidget, self).__init__(*args, **kwargs)
 
     def create_option(self, name, value, label, selected, index, subindex=None, attrs=None):
         result = super(TagFormWidget, self).create_option(
-            name=name, value=value, label=label, selected=selected,
-            index=index, subindex=subindex, attrs=attrs
+            name=name, value=value, label='{}'.format(conditional_escape(label)),
+            selected=selected, index=index, subindex=subindex, attrs=attrs
         )
 
         result['attrs']['data-color'] = self.queryset.get(pk=value).color
 
         return result

Vulnerable code:             name=name, value=value, label=label, selected=selected,
            index=index, subindex=subindex, attrs=attrs
Fixed code: 3.0.3 (2018-08-17)
==================
- Add explicit casting of escaped tag labels to prevent exploit
  of cross site scripting. Thanks to Lokesh (@lokesh1095) for
  the report and proposed solutions. Closes GitLab issue #496.

from django.utils.html import conditional_escape
            name=name, value=value, label='{}'.format(conditional_escape(label)),
            selected=selected, index=index, subindex=subindex, attrs=attrs