CVE-2018-25097 (Java, published 2024-01-02T16:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of the patch is 0df8a5e8722188744973168648e4c74c69ce67fd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249420.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/acumos/design-studio
Files changed:
docs/release-notes.rst
ds-compositionengine/pom.xml
ds-compositionengine/src/main/java/org/acumos/designstudio/ce/controller/ArtfactDetailsController.java
ds-compositionengine/src/main/java/org/acumos/designstudio/ce/controller/SolutionController.java
ds-compositionengine/src/main/java/org/acumos/designstudio/ce/util/SanitizeUtils.java
Commit message: Senitization for CSS Vulnerability

Issue-Id : ACUMOS-1650
Description : Senitization for CSS Vulnerability - Design Studio

Change-Id: If8fd4b9b06f884219d93881f7922421870de8e3d
Signed-off-by: Ramanaiah Pirla <RP00490596@techmahindra.com>


Vulnerable code:
		</dependency>		
			result = iacumosCatalog.readArtifact(userId, solutionId, version, props.getArtifactType().trim());
			result = iacumosCatalog.readArtifact(userId, solutionId, version, props.getProtoArtifactType().trim());
			dscs.setSolutionId(solutionId);
					results = solutionService.addNode(userId, solutionId, version, cid, node);
			result = solutionService.readCompositeSolutionGraph(userId, solutionId, version);
			result = solutionService.modifyNode(userId, solutionId, version, cid, nodeId, nodeName, ndata, fieldMap, databrokerMap, collatorMap, splitterMap);
			result = solutionService.modifyLink(userId, cid, solutionId, version, linkId, linkName);
			boolean deleted = compositeServiceImpl.deleteCompositeSolution(userId, solutionId, version);
				boolean deletedNode = solutionService.deleteNode(userId, solutionId, version, cid, nodeId);
			result = compositeServiceImpl.closeCompositeSolution(userId, solutionId, solutionVersion, cid);
			result = compositeServiceImpl.clearCompositeSolution(userId, solutionId, solutionVersion, cid);
			result = compositeServiceImpl.validateCompositeSolution(userId, solutionName, solutionId, version);
					linkAdded = solutionService.addLink(userId, solutionId, version, linkName, linkId, sourceNodeName,
				boolean deletedLink = solutionService.deleteLink(userId, solutionId, version, cid, linkId);
        	successErrorMessage = compositeServiceImpl.setProbeIndicator(userId, solutionId, version, cid,probeIndicator);

Fixed code:
* ACUMOS-1650 : Senitization for CSS Vulnerability
		</dependency>
		<dependency>
		 	<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
		 	<artifactId>owasp-java-html-sanitizer</artifactId>
		 	<version>20180219.1</version>
		</dependency>	
import org.acumos.designstudio.ce.util.SanitizeUtils;
			result = iacumosCatalog.readArtifact(userId, SanitizeUtils.sanitize(solutionId), version, props.getArtifactType().trim());
			result = iacumosCatalog.readArtifact(userId, SanitizeUtils.sanitize(solutionId), version, props.getProtoArtifactType().trim());
import org.acumos.designstudio.ce.util.SanitizeUtils;
			dscs.setSolutionId(SanitizeUtils.sanitize(solutionId));
					results = solutionService.addNode(userId, SanitizeUtils.sanitize(solutionId), version, cid, node);
			result = solutionService.readCompositeSolutionGraph(userId, SanitizeUtils.sanitize(solutionId), version);
			result = solutionService.modifyNode(userId, SanitizeUtils.sanitize(solutionId), version, cid, nodeId, nodeName, ndata, fieldMap, databrokerMap, collatorMap, splitterMap);
			result = solutionService.modifyLink(userId, cid, SanitizeUtils.sanitize(solutionId), version, linkId, linkName);
			boolean deleted = compositeServiceImpl.deleteCompositeSolution(userId, SanitizeUtils.sanitize(solutionId), version);
				boolean deletedNode = solutionService.deleteNode(userId, SanitizeUtils.sanitize(solutionId), version, cid, nodeId);
			result = compositeServiceImpl.closeCompositeSolution(userId, SanitizeUtils.sanitize(solutionId), solutionVersion, cid);
			result = compositeServiceImpl.clearCompositeSolution(userId, SanitizeUtils.sanitize(solutionId), solutionVersion, cid);
			result = compositeServiceImpl.validateCompositeSolution(userId, solutionName, SanitizeUtils.sanitize(solutionId), version);
					linkAdded = solutionService.addLink(userId, SanitizeUtils.sanitize(solutionId), version, linkName, linkId, sourceNodeName,
				boolean deletedLink = solutionService.deleteLink(userId, SanitizeUtils.sanitize(solutionId), version, cid, linkId);
        	successErrorMessage = compositeServiceImpl.setProbeIndicator(userId, SanitizeUtils.sanitize(solutionId), version, cid,probeIndicator);
/*-
 * ===============LICENSE_START=======================================================
 * Acumos
 * ===================================================================================
 * Copyright (C) 2017 AT&T Intellectual Property & Tech Mahindra. All rights reserved.
 * ===================================================================================
 * This Acumos software file is distributed by AT&T and Tech Mahindra
 * under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *  
 *      http://www.apache.org/licenses/LICENSE-2.0
 *  
 * This file is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * ===============LICENSE_END=========================================================
 */

package org.acumos.designstudio.ce.util;

import org.owasp.html.HtmlPolicyBuilder;
import org.owasp.html.PolicyFactory;

public class SanitizeUtils {

	public static PolicyFactory genericPolicy = new HtmlPolicyBuilder()
    	    .requireRelNofollowOnLinks()
    	    .allowTextIn("@")
    	    .toFactory();
    	
	public static String sanitize(String html) {
		if(null == html){
			return html;
		}
		return genericPolicy.sanitize(html);
	}
    	
}