CVE-2023-3551 (PHP, published 2023-07-08T09:15Z)
Description: value:  Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/js/functions.js
includes/libraries/anti-xss-master/src/voku/helper/AntiXSS.php
pages/2fa.js.php
pages/2fa.php
pages/admin.js.php
pages/users.js.php
sources/logs.datatables.php
Commit message: 3.0.10

Fix for #3779, #3775
Fix for improper handling of input in admin setting pages


Vulnerable code:
)
        text
    let string = '';
    string = simplePurifier($(field).val(), bHtml, bSvg, bSvgFilters);
    console.log('2FA loaded')

    $(document).on('click', '.generate-key', function() {
        var size = $(this).data('length'),
            target = $(this).closest('.input-group').find('input').attr('id');

        $.post(
            'sources/main.queries.php', {
                type: 'generate_new_key',
                type_category: 'action_key',
                size: size
            },
            function(data) {
                $('#' + target).val(data[0].key);
            },
            'json'
        );
    })


        var data = "{\"ikey\":\"" + sanitizeString($("#duo_ikey").val()) + "\", \"skey\":\"" + sanitizeString($("#duo_skey").val()) + "\", \"host\":\"" + sanitizeString($("#duo_host").val()) + "\"}";
            'duo_ikey': $('#duo_ikey').val(),
            'duo_skey': $('#duo_skey').val(),
            'duo_host': $('#duo_host').val()
                    toastr.info(
                                        <input type="text" class="form-control form-control-sm" id="ga_website_name" value="<?php echo isset($SETTINGS['ga_website_name']) === true ? $SETTINGS['ga_website_name'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm" id="duo_ikey" value="<?php echo isset($SETTINGS['duo_ikey']) === true ? $SETTINGS['duo_ikey'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm" id="duo_skey" value="<?php echo isset($SETTINGS['duo_skey']) === true ? $SETTINGS['duo_skey'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm" id="duo_host" value="<?php echo isset($SETTINGS['duo_host']) === true ? $SETTINGS['duo_host'] : ''; ?>">
        value = fieldDomPurifierWithWarning('#' + field);
                    validEmailRegex = /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/;
    $aColumns = ['increment_id', 'created_at', 'updated_at', 'process_type', 'is_in_progress'];
    $sWhere = ' WHERE ((finished_at = "")';
    'SELECT COUNT(increment_id)
        'SELECT *
        'SELECT COUNT(increment_id)
        'SELECT *

Fixed code:
) 
        sanitizeDom(text)
    bSetting = false,
    let string = '',
        currentString = $(field).val();

    // if bSetting is true, we use the setting value
    // remove any closing ', string that could corrupt the setting
    if (bSetting === true) {
        currentString = currentString.replace(/',/g, '');
    }
    string = simplePurifier(
        sanitizeDom(currentString),
        bHtml,
        bSvg,
        bSvgFilters
    );
}

const sanitizeDom = (str) => {
    const div = document.createElement('div');
    div.textContent = str;
    newString = div.innerHTML;
    div.remove();
    return newString;
        UTF8::checkForSupport();
        toastr
            .info('<?php echo langHdl('loading_item'); ?> ... <i class="fas fa-circle-notch fa-spin fa-2x"></i>');
            'duo_ikey': sanitizeString($('#duo_ikey').val()),
            'duo_skey': sanitizeString($('#duo_skey').val()),
            'duo_host': sanitizeString($('#duo_host').val())
                    toastr.success(
                                        <input type="text" class="form-control form-control-sm purify" data-field="label" id="ga_website_name" value="<?php echo isset($SETTINGS['ga_website_name']) === true ? $SETTINGS['ga_website_name'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm purify" data-field="label" id="duo_ikey" value="<?php echo isset($SETTINGS['duo_ikey']) === true ? $SETTINGS['duo_ikey'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm purify" data-field="label" id="duo_skey" value="<?php echo isset($SETTINGS['duo_skey']) === true ? $SETTINGS['duo_skey'] : ''; ?>">
                                        <input type="text" class="form-control form-control-sm purify" data-field="label" id="duo_host" value="<?php echo isset($SETTINGS['duo_host']) === true ? $SETTINGS['duo_host'] : ''; ?>">
        value = fieldDomPurifierWithWarning('#' + field, false, false, false, true);
                    validEmailRegex = /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,15})+$/;
    $aColumns = ['p.increment_id', 'p.created_at', 'p.updated_at', 'p.process_type', 'p.is_in_progress'];
    $sWhere = ' WHERE ((p.finished_at = "")';
    'SELECT COUNT(p.increment_id)
        'SELECT p.*
        'SELECT COUNT(p.increment_id)
        'SELECT p.*