CVE-2022-3225 (JavaScript, published 2022-09-16T17:15Z)
Description: value: Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.


Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/budibase/budibase
Files changed:
packages/bbui/src/Tooltip/TooltipWrapper.svelte
packages/builder/src/builderStore/dataBinding.js
packages/builder/src/helpers/data/utils.js
packages/builder/src/pages/builder/app/[application]/data/datasource/[selectedDatasource]/rest/[query]/index.svelte
packages/worker/src/api/controllers/global/self.js
packages/worker/src/api/controllers/global/users.ts
Commit message: Fixing issue introduced by fix for #7683 - encoding the query string caused handlebars statements to break, this rectifies that.


Vulnerable code:
    z-index: 100;
  tables as tablesStore,
  makePropSafe,
  isJSBinding,
    let parsedQuery = readableToRuntimeBinding(bindings, ctx[key])
    acc[key] = parsedQuery
    let parsedQuery = runtimeToReadableBinding(bindings, ctx[key])
    acc[key] = parsedQuery
    paramObj[split[0]] = split.slice(1).join("=")
      str += `${key}=${encodeURIComponent(value || "")}`
/**
 * Remove the attributes that are session based from the current user,
 * so that stale values are not written to the db
 */
const removeSessionAttributesFromUser = ctx => {
  delete ctx.request.body.csrfToken
  delete ctx.request.body.account
  delete ctx.request.body.accountPortalAccess
  delete ctx.request.body.budibaseAccess
  delete ctx.request.body.license
  if (ctx.request.body.password) {
    ctx.request.body.password = await hash(ctx.request.body.password)
  // don't allow sending up an ID/Rev, always use the existing one
  delete ctx.request.body._id
  delete ctx.request.body._rev
  removeSessionAttributesFromUser(ctx)
    ...ctx.request.body,
  users as usersCore,
    let response = await users.bulkDelete(userIds)

    ctx.body = response

Fixed code:
    z-index: 200;
  tables as tablesStore,
  isJSBinding,
  makePropSafe,
    acc[key] = readableToRuntimeBinding(bindings, ctx[key])
    acc[key] = runtimeToReadableBinding(bindings, ctx[key])
import { findHBSBlocks } from "@budibase/string-templates"
    console.log(split[1])
    paramObj[split[0]] = decodeURIComponent(split.slice(1).join("="))
      const bindings = findHBSBlocks(value)
      let count = 0
      const bindingMarkers = {}
      bindings.forEach(binding => {
        const marker = `BINDING...${count++}`
        value = value.replace(binding, marker)
        bindingMarkers[marker] = binding
      })
      let encoded = encodeURIComponent(value || "")
      Object.entries(bindingMarkers).forEach(([marker, binding]) => {
        encoded = encoded.replace(marker, binding)
      })
      str += `${key}=${encoded}`
    console.log(breakQs)
    z-index: 200;
const sanitiseUserUpdate = ctx => {
  const allowed = ["firstName", "lastName", "password", "forceResetPassword"]
  const resp = {}
  for (let [key, value] of Object.entries(ctx.request.body)) {
    if (allowed.includes(key)) {
      resp[key] = value
    }
  }
  return resp

  const userUpdateObj = sanitiseUserUpdate(ctx)
  if (userUpdateObj.password) {
    userUpdateObj.password = await hash(userUpdateObj.password)
    ...userUpdateObj,
    ctx.body = await users.bulkDelete(userIds)