CVE-2022-4590 (Other, published 2022-12-17T19:15Z)
Description: value: A vulnerability was found in mschaef toto up to 1.4.20. It has been classified as problematic. This affects an unknown part of the component Todo List Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.21 is able to address this issue. The name of the patch is fdc825ac5249f40683377e8a526a06cdc6870125. It is recommended to upgrade the affected component. The identifier VDB-216177 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mschaef/toto
Files changed:
src/toto/todo/todo_list.clj
src/toto/todo/todo_list_manager.clj
src/toto/view/page.clj
Commit message: Escape user entered HTML in several different locations throughout the UI, to help mitigate against XSS attacks.


Vulnerable code:
            [hiccup.form :as form]
            [hiccup.util :as util]
(defn ensure-string-breakpoints [ s n ]
  (clojure.string/join html-breakpoint (partition-string s n)))
    (-> (util/escape-html
    (form/form-to
       (form/hidden-field "item-list-id" list-id)
        (form/select-options (map (fn [ sublist ]
                                    [ (:desc sublist) (:sublist_id sublist)])
     (form/text-field (cond-> {:maxlength "1024"
     (form/hidden-field "item-priority" "0")
              created-by-name])]))]
   (form/select-options [[ "-" "-"]
   (form/form-to { :class "embedded "} [:get (shref "/list/" list-id)]
   (form/form-to { :class "embedded "} [:get (shref "/list/" list-id "/completions")]
         (:desc sublist-details)]]
   (form/select-options (map (fn [ list-info ]
                               [ (:desc list-info) (:todo_list_id list-info)])
                             (remove
                              #(= excluded-list-id (:todo_list_id %))
                              (data/get-todo-lists-by-user (auth/current-user-id)))))])
            [hiccup.form :as form]
  (form/form-to
   (form/text-field {:maxlength "32"
    (form/check-box "is-view" false "Y")
   (form/form-to {} [:post (shref "/list/" list-id "/sort")]
     (form/select-options [["Description" "desc"]
       (form/check-box "is-public" (:is_public list-details))
                      (form/hidden-field user-parameter-name "on")]
                     (form/check-box user-parameter-name (in? list-owners user-id)))
                (form/check-box (str "list_" list-id)
                                (in? view-sublist-ids list-id))
                (:desc todo-list)]))
     {:title (str list-type " Details: " list-name)
       "List Details: " list-name]
      (form/form-to
        (form/text-field { :maxlength "32" } "list-name" list-name)]
            [hiccup.page :as page]
            [hiccup.form :as form]
        (form/form-to [:post form-post-to] contents)
      (form/text-field {:maxlength "128"
      (form/text-field (cond-> {:maxlength "128"
      (form/text-area {:maxlength "4096"
     (form/hidden-field "current-uri" (shref))
   (page/include-css (resource "toto.css")
   (page/include-js (resource "DragDropTouch.js"))])
     page-title
  (page/html5

Fixed code:
            [hiccup.form :as hiccup-form]
            [hiccup.util :as hiccup-util]
(defn- ensure-string-breakpoints [ s n ]
  (clojure.string/join html-breakpoint (map hiccup-util/escape-html (partition-string s n))))
    (-> (hiccup-util/escape-html
    (hiccup-form/form-to
       (hiccup-form/hidden-field "item-list-id" list-id)
        (hiccup-form/select-options (map (fn [ sublist ]
                                           [(hiccup-util/escape-html (:desc sublist))
                                            (:sublist_id sublist)])
     (hiccup-form/text-field (cond-> {:maxlength "1024"
     (hiccup-form/hidden-field "item-priority" "0")
              (hiccup-util/escape-html
               created-by-name)])]))]
   (hiccup-form/select-options [[ "-" "-"]
   (hiccup-form/form-to { :class "embedded "} [:get (shref "/list/" list-id)]
   (hiccup-form/form-to { :class "embedded "} [:get (shref "/list/" list-id "/completions")]
         (hiccup-util/escape-html
          (:desc sublist-details))]]
   (hiccup-form/select-options
    (map (fn [ list-info ]
           [(hiccup-util/escape-html (:desc list-info))
            (:todo_list_id list-info)])
         (remove
          #(= excluded-list-id (:todo_list_id %))
          (data/get-todo-lists-by-user (auth/current-user-id)))))])
            [hiccup.form :as hiccup-form]
            [hiccup.util :as hiccup-util]
  (hiccup-form/form-to
   (hiccup-form/text-field {:maxlength "32"
    (hiccup-form/check-box "is-view" false "Y")
   (hiccup-form/form-to {} [:post (shref "/list/" list-id "/sort")]
     (hiccup-form/select-options [["Description" "desc"]
       (hiccup-form/check-box "is-public" (:is_public list-details))
                      (hiccup-form/hidden-field user-parameter-name "on")]
                     (hiccup-form/check-box user-parameter-name (in? list-owners user-id)))
                (hiccup-form/check-box (str "list_" list-id)
                                       (in? view-sublist-ids list-id))
                (hiccup-util/escape-html
                 (:desc todo-list))]))
     {:title (str list-type " Details: " (hiccup-util/escape-html list-name))
       "List Details: " (hiccup-util/escape-html list-name)]
      (hiccup-form/form-to
        (hiccup-form/text-field { :maxlength "32" } "list-name" list-name)]
            [hiccup.page :as hiccup-page]
            [hiccup.form :as hiccup-form]
            [hiccup.util :as hiccup-util]
        (hiccup-form/form-to [:post form-post-to] contents)
      (hiccup-form/text-field {:maxlength "128"
      (hiccup-form/text-field (cond-> {:maxlength "128"
      (hiccup-form/text-area {:maxlength "4096"
     (hiccup-form/hidden-field "current-uri" (shref))
   (hiccup-page/include-css (resource "toto.css")
   (hiccup-page/include-js (resource "DragDropTouch.js"))])
     (hiccup-util/escape-html page-title)
  (hiccup-page/html5