CVE-2022-0159 (Other, published 2022-01-12T03:15Z)
Description: value: orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/orchardcms/orchardcore
Files changed:
src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs
src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml
src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs
src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml
src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml
src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml
src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml
src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml
src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml
src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml
src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml
src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml
src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml
src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml
Commit message: Fix encoding issues (#11008)



Vulnerable code:
                    dashboardCreatable.Add(new SelectListItem(new LocalizedString(ctd.DisplayName, ctd.DisplayName).Value, ctd.Name));
                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
                        creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
                            creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", Html.Raw(typeDisplayName)])</h1></zone>
<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", Html.Raw(typeDisplayName)])</h1></zone>
                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", Html.Raw(typeDisplayName)])</h1></zone>
    @T[Model.Message]
    @T[Model.Message]
    @T[Model.Message]
        @T[Model.Size + "%"]
                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + contentItemSummary.ContentItem.Content.LayerMetadata.Layer + "</span>"));
            <option value="@option" selected="@(Model.UsersCanRegister == option)">@T[option.ToString()]</option>
            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[action] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>
                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[action] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>

Fixed code:
                    dashboardCreatable.Add(new SelectListItem(ctd.DisplayName, ctd.Name));
                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
                        creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
                            creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", typeDisplayName])</h1></zone>
<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", typeDisplayName])</h1></zone>
                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", typeDisplayName])</h1></zone>
    @Model.Message
    @Model.Message
    @Model.Message
        @T[Html.Encode(Model.Size + "%")] @* Allows for custom string reprentations like half, quarter, ...*@
                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + Html.Encode(contentItemSummary.ContentItem.Content.LayerMetadata.Layer) + "</span>"));
            <option value="@option" selected="@(Model.UsersCanRegister == option)">
                @{
                    switch (option)
                    {
                        case UserRegistrationType.NoRegistration: @T["NoRegistration"]; break;
                        case UserRegistrationType.AllowRegistration: @T["AllowRegistration"]; break;
                        case UserRegistrationType.AllowOnlyExternalUsers: @T["AllowOnlyExternalUsers"]; break;
                    }
                }
            </option>
            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>
                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>