CVE-2023-33962 (Java, published 2023-05-30T22:15Z)
Description: value: JStachio is a  type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, theft of sensitive information, or even the propagation of malware.

Version 1.0.1 contains a patch for this issue. To mitigate this vulnerability, the template engine should properly escape special characters, including single quotes. Common practice is to escape `'` as `&#39`. As a workaround, users can avoid this issue by using only double quotes `"` for HTML attributes.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jstachio/jstachio
Files changed:
api/jstachio/src/main/java/io/jstach/jstachio/escapers/Html.java
api/jstachio/src/main/java/io/jstach/jstachio/escapers/HtmlEscaper.java
test/examples/src/test/java/io/jstach/examples/htmlescaper/HtmlEscapeTest.java
test/examples/src/test/java/io/jstach/examples/htmlescaper/package-info.java
test/examples/src/test/java/io/jstach/examples/lambda/LambdaPartialTest.java
Commit message: Fix #157 add more aggressive html5 escaping


Vulnerable code:
 * <ul>
 * <li>'&quot;'</li>
 * <li>'&gt;'</li>
 * <li>'&lt;'</li>
 * <li>'&amp;'</li>
 * </ul>
 *
	private static final String QUOT = "&quot;";
	private static final String GT = "&gt;";
	private static final String LT = "&lt;";
	private static final String AMP = "&amp;";
				case '&' -> {
				case '<' -> {

				case '>' -> {
				case '"' -> {
					a.append(QUOT);

			case '"' -> {
				a.append(QUOT);
				LambdaSectionParent[stuff=ignore]

Fixed code:
 * <table border="1">
 * <caption><strong>Escape table</strong></caption>
 * <tr>
 * <th>Character</th>
 * <th>Escaped String</th>
 * </tr>
 * <tr>
 * <td>'<code>&quot;</code>'</td>
 * <td>{@value HtmlEscaper#QUOT}</td>
 * </tr>
 * <tr>
 * <td>'<code>&amp;</code>'</td>
 * <td>{@value HtmlEscaper#AMP}</td>
 * </tr>
 * <tr>
 * <td>'<code>&#x27;</code>'</td>
 * <td>{@value HtmlEscaper#APOS}</td>
 * </tr>
 * <tr>
 * <td>'<code>&lt;</code>'</td>
 * <td>{@value HtmlEscaper#LT}</td>
 * </tr>
 * <tr>
 * <td>'<code>=</code>'</td>
 * <td>{@value HtmlEscaper#EQUAL}</td>
 * </tr>
 * <tr>
 * <td>'<code>&gt;</code>'</td>
 * <td>{@value HtmlEscaper#GT}</td>
 * </tr>
 * <tr>
 * <td>'<code>&#x60;</code>'</td>
 * <td>{@value HtmlEscaper#BACK_TICK}</td>
 * </tr>
 * </table>
 * <br />
	static final String QUOT = "&quot;";
	static final String AMP = "&amp;";
	static final String APOS = "&#x27;";
	static final String LT = "&lt;";

	static final String EQUAL = "&#x3D;";

	static final String GT = "&gt;";

	static final String BACK_TICK = "&#x60;";
				case '"' -> { // 34
					a.append(csq, start, i);
					start = i + 1;
					a.append(QUOT);
				}
				case '&' -> { // 38
				case '\'' -> { // 39
					a.append(csq, start, i);
					start = i + 1;
					a.append(APOS);
				}
				case '<' -> { // 60
				case '=' -> { // 61
					a.append(csq, start, i);
					start = i + 1;
					a.append(EQUAL);
				}
				case '>' -> { // 62
				case '`' -> { // 96
					a.append(BACK_TICK);
			case '"' -> {
				a.append(QUOT);
			}
			case '\'' -> {
				a.append(APOS);
			}
			case '=' -> {
				a.append(EQUAL);
			}
			case '`' -> {
				a.append(BACK_TICK);
package io.jstach.examples.htmlescaper;

import static org.junit.Assert.assertEquals;

import org.junit.Test;

import io.jstach.jstache.JStache;

public class HtmlEscapeTest {

	@JStache(template = """
			<div alt="{{attr}}">
			{{body}}
			</div>
			""")
	public record EscapeModel(String attr, String body) {

	}

	@Test
	public void testName() throws Exception {
		var m = new EscapeModel("\"&\'<=>`", "\"&\'<=>`");
		String actual = EscapeModelRenderer.of().execute(m);
		String expected = """
				<div alt="&quot;&amp;&#x27;&lt;&#x3D;&gt;&#x60;">
				&quot;&amp;&#x27;&lt;&#x3D;&gt;&#x60;
				</div>
				""";

		assertEquals(expected, actual);
	}

}
@org.eclipse.jdt.annotation.NonNullByDefault
package io.jstach.examples.htmlescaper;
				LambdaSectionParent[stuff&#x3D;ignore]