CVE-2022-2290 (JavaScript, published 2022-07-03T06:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zadam/trilium
Files changed:
package-lock.json
src/routes/api/export.js
src/routes/api/files.js
src/routes/api/image.js
src/routes/api/note_revisions.js
src/routes/custom.js
src/routes/routes.js
src/services/auth.js
src/share/routes.js
Commit message: set correct content type for error messages


Vulnerable code:
  "version": "0.52.1-beta",
      "version": "0.52.1-beta",
        res.status(500).send(message);
        res.status(500).send(message);
        return res.status(404).send(`Note ${noteId} doesn't exist.`);
     * special "image" type. the canvas is actually type application/json 
            
            res.status(500).send("there was an error parsing excalidraw to svg");
        return res.status(400).send(`Note revision ${req.params.noteRevisionId} does not belong to note ${req.params.noteId}`);
        return res.status(401).send("Protected session not available");
                res.status(500).send(e.message);
    res.status(404).send(message);
                            res.status(500).send(e.message);
            res.status(500).send(e.message);
    res.status(401).send(message);
        res.status(400).send('Database is not initialized yet.');
        res.status(400).send('Password has not been set yet. Please set a password and repeat the action');
        res.status(401).send('Incorrect password');
            res.setHeader('Content-Type', note.mime);
            res.send(note.getContent());
            return res.status(404).send(`Note '${noteId}' not found`);
            return res.status(404).send(`Note '${noteId}' not found`);
            return res.status(404).send(`Note '${req.params.noteId}' not found`);
            return res.status(400).send("Requested note is not a shareable image");
             * special "image" type. the canvas is actually type application/json 
                res.status(500).send("there was an error parsing excalidraw to svg");
            return res.status(404).send(`Note '${noteId}' not found`);

Fixed code:
  "version": "0.52.3",
      "version": "0.52.3",
        res.setHeader("Content-Type", "text/plain")
            .status(500)
            .send(message);
        res.setHeader("Content-Type", "text/plain")
            .status(500)
            .send(message);
        return res.setHeader("Content-Type", "text/plain")
            .status(404)
            .send(`Note ${noteId} doesn't exist.`);
     * special "image" type. the canvas is actually type application/json

            res.setHeader("Content-Type", "text/plain")
                .status(500)
                .send("there was an error parsing excalidraw to svg");
        return res.setHeader("Content-Type", "text/plain")
            .status(400)
            .send(`Note revision ${req.params.noteRevisionId} does not belong to note ${req.params.noteId}`);
        return res.setHeader("Content-Type", "text/plain")
            .status(401)
            .send("Protected session not available");
                res.setHeader("Content-Type", "text/plain")
                    .status(500)
                    .send(e.message);
    res.setHeader("Content-Type", "text/plain")
        .status(404)
        .send(message);
        if (statusCode >= 400) {
            res.setHeader("Content-Type", "text/plain");
        }

                            res.setHeader("Content-Type", "text/plain")
                                .status(500)
                                .send(e.message);
            res.setHeader("Content-Type", "text/plain")
                .status(500)
                .send(e.message);
    res.setHeader("Content-Type", "text/plain")
        .status(401)
        .send(message);
        res.setHeader("Content-Type", "text/plain")
            .status(400)
            .send('Database is not initialized yet.');
        res.setHeader("Content-Type", "text/plain")
            .status(400)
            .send('Password has not been set yet. Please set a password and repeat the action');
        res.setHeader("Content-Type", "text/plain")
            .status(401)
            .send('Incorrect password');
            res.setHeader('Content-Type', note.mime)
                .send(note.getContent());
            return res.setHeader("Content-Type", "text/plain")
                .status(404)
                .send(`Note '${noteId}' not found`);
            return res.setHeader("Content-Type", "text/plain")
                .status(404)
                .send(`Note '${noteId}' not found`);
            return res.setHeader('Content-Type', 'text/plain')
                .status(404)
                .send(`Note '${req.params.noteId}' not found`);
            return res.setHeader('Content-Type', 'text/plain')
                .status(400)
                .send("Requested note is not a shareable image");
             * special "image" type. the canvas is actually type application/json
                res.setHeader('Content-Type', 'text/plain')
                    .status(500)
                    .send("there was an error parsing excalidraw to svg");
            return res.setHeader('Content-Type', 'text/plain')
                .status(404)
                .send(`Note '${noteId}' not found`);