CVE-2022-0539: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-09T14:15Z
Repository: https://github.com/ptrofimov/beanstalk_console
Language: PHP
Files changed: lib/tpl/main.php, lib/tpl/serversList.php
Commit date: 2022-02-08 20:48:42 +0700
Commit message: applying htmlspecialchars for sanitization output
Fix issue XSS
Disclosure : https://huntr.dev/bounties/5f41b182-dda2-4c6f-9668-2a9afaed53af/

Diff: diff --git a/lib/tpl/main.php b/lib/tpl/main.php
index 01b8a75..e40c136 100644
--- a/lib/tpl/main.php
+++ b/lib/tpl/main.php
@@ -63,11 +63,11 @@ if ($server) {
                                         <?php echo $serverLabel ?> <span class="caret"></span>
                                     </a>
                                     <ul class="dropdown-menu">
                                         <li><a href="./?">All servers</a></li>
                                         <?php foreach (array_diff($servers, array($server)) as $key => $serverItem): ?>
-                                            <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
+                                            <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                         <?php endforeach ?>
                                     </ul>
                                 </li>
                             <?php else: ?>
                                 <!-- Server dropdown: All, then remaining -->
@@ -75,11 +75,11 @@ if ($server) {
                                     <a href="#" class="dropdown-toggle" data-toggle="dropdown">
                                         All servers <span class="caret"></span>
                                     </a>
                                     <ul class="dropdown-menu">
                                         <?php foreach ($servers as $key => $serverItem): ?>
-                                            <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
+                                            <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                         <?php endforeach ?>
                                     </ul>
                                 </li>
                             <?php endif ?>
 
diff --git a/lib/tpl/serversList.php b/lib/tpl/serversList.php
index 6e05d37..46c5833 100644
--- a/lib/tpl/serversList.php
+++ b/lib/tpl/serversList.php
@@ -42,13 +42,13 @@ if (!empty($servers)):
                             $label = $server;
                         }
                         ?>
                         <tr>
                             <?php if (empty($stats)): ?>
-                                <td style="white-space: nowrap;"><?php echo $label ?></td>
+                                <td style="white-space: nowrap;"><?php echo htmlspecialchars($label) ?></td>
                             <?php else: ?>
-                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo $server ?>"><?php echo $label; ?></a></td>
+                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo htmlspecialchars($server) ?>"><?php echo htmlspecialchars($label); ?></a></td>
                             <?php endif ?>
                             <?php foreach ($stats as $key => $item): ?>
                                 <?php
                                 $classes = array("td-$key");
                                 if (!in_array($key, $visible)) {
@@ -67,11 +67,11 @@ if (!empty($servers)):
                                 <?php endforeach ?>
                                 <?php if (empty($stats)): ?>
                                 <td colspan="<?php echo count($visible) ?>" class="row-full">&nbsp;</td>
                             <?php endif ?>
                             <td><?php if (array_intersect(array($server), $cookieServers)): ?>
-                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo $server ?>"><span
+                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo htmlspecialchars($server) ?>"><span
                                             class="glyphicon glyphicon-minus"></span></a>
                                     <?php endif; ?>
                             </td>
                         </tr>
                     <?php endforeach ?>

Vulnerable code:                                             <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
                                            <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
                                <td style="white-space: nowrap;"><?php echo $label ?></td>
                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo $server ?>"><?php echo $label; ?></a></td>
                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo $server ?>"><span
Fixed code:                                             <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                            <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                <td style="white-space: nowrap;"><?php echo htmlspecialchars($label) ?></td>
                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo htmlspecialchars($server) ?>"><?php echo htmlspecialchars($label); ?></a></td>
                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo htmlspecialchars($server) ?>"><span