CVE-2021-4265 (Ruby, published 2022-12-21T19:15Z)
Description: value: A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 924d16008cfcc09356c87db01848e45290cb58ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216467.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/siwapp/siwapp-ror
Files changed:
app/models/common.rb
app/models/customer.rb
config/environments/production.rb
db/migrate/20160907152236_default_for_enabled.rb
db/migrate/20160908093323_add_indexes_on_deleted_column.rb
db/migrate/20160913081503_remove_status_from_commons.rb
db/migrate/20160915000824_add_active_to_customer.rb
db/migrate/20160915094942_add_failed_to_commons.rb
db/migrate/20160923100618_series_first_number.rb
db/migrate/20160929124104_email_and_print_template_to_common.rb
db/migrate/20160929133954_email_and_print_default_templates_to_template.rb
db/migrate/20161025134552_change_customer_index.rb
db/migrate/20161026092553_add_template_subject.rb
db/migrate/20161028103504_add_invoice_number_unique_number.rb
db/migrate/20161207184222_remove_tax_amount.rb
db/migrate/20161208171651_remove_commons_amounts.rb
db/migrate/20170112115658_remove_invoice_unique_number.rb
db/migrate/20170209101048_remove_customers_unique_name.rb
db/migrate/20170216122053_add_unique_index_to_invoice_series_and_number.rb
db/migrate/20170217120023_add_deleted_number_to_commons.rb
db/migrate/20170223101022_add_commons_customer_id_not_null.rb
db/migrate/20170608155530_add_currency_to_commons.rb
Commit message: Fix possible XSS issues (#365)

* some fixes for old migrations, that allows new migrations

* force ssl default true unless env var

* check address no html tags

Vulnerable code:
  # config.force_ssl = true
class DefaultForEnabled < ActiveRecord::Migration
class AddIndexesOnDeletedColumn < ActiveRecord::Migration
class RemoveStatusFromCommons < ActiveRecord::Migration
class AddActiveToCustomer < ActiveRecord::Migration
class AddFailedToCommons < ActiveRecord::Migration
class SeriesFirstNumber < ActiveRecord::Migration
class EmailAndPrintTemplateToCommon < ActiveRecord::Migration
class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration
class ChangeCustomerIndex < ActiveRecord::Migration
class AddTemplateSubject < ActiveRecord::Migration
class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration
class RemoveTaxAmount < ActiveRecord::Migration
class RemoveCommonsAmounts < ActiveRecord::Migration
class RemoveInvoiceUniqueNumber < ActiveRecord::Migration
class RemoveCustomersUniqueName < ActiveRecord::Migration
class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration
class AddDeletedNumberToCommons < ActiveRecord::Migration
class AddCommonsCustomerIdNotNull < ActiveRecord::Migration
class AddCurrencyToCommons < ActiveRecord::Migration

Fixed code:
  validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "wrong format" }
  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "wrong format" }
  validates :invoicing_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "Wrong address format" }
  validates :shipping_address, format: { without: /<(.*)>.*?|<(.*) \/>/,
    message: "Wrong address format" }
  config.force_ssl = ENV['NO_FORCE_SSL'].present? ? false : true
class DefaultForEnabled < ActiveRecord::Migration[4.2]
class AddIndexesOnDeletedColumn < ActiveRecord::Migration[4.2]
class RemoveStatusFromCommons < ActiveRecord::Migration[4.2]
class AddActiveToCustomer < ActiveRecord::Migration[4.2]
class AddFailedToCommons < ActiveRecord::Migration[4.2]
class SeriesFirstNumber < ActiveRecord::Migration[4.2]
class EmailAndPrintTemplateToCommon < ActiveRecord::Migration[4.2]
class EmailAndPrintDefaultTemplatesToTemplate < ActiveRecord::Migration[4.2]
class ChangeCustomerIndex < ActiveRecord::Migration[4.2]
class AddTemplateSubject < ActiveRecord::Migration[4.2]
class AddInvoiceNumberUniqueNumber < ActiveRecord::Migration[4.2]
class RemoveTaxAmount < ActiveRecord::Migration[4.2]
class RemoveCommonsAmounts < ActiveRecord::Migration[4.2]
class RemoveInvoiceUniqueNumber < ActiveRecord::Migration[4.2]
class RemoveCustomersUniqueName < ActiveRecord::Migration[4.2]
class AddUniqueIndexToInvoiceSeriesAndNumber < ActiveRecord::Migration[4.2]
class AddDeletedNumberToCommons < ActiveRecord::Migration[4.2]
class AddCommonsCustomerIdNotNull < ActiveRecord::Migration[4.2]
class AddCurrencyToCommons < ActiveRecord::Migration[4.2]