CVE-2021-25963 (Python, published 2021-09-30T08:15Z)
Description: value: In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/shuup/shuup
Files changed:
CHANGELOG.md
shuup/admin/utils/urls.py
shuup/core/basket/command_dispatcher.py
shuup/front/checkout/_process.py
shuup/front/urls.py
shuup/utils/excs.py
shuup/xtheme/urls.py
shuup/xtheme/views/command.py
shuup/xtheme/views/editor.py
shuup/xtheme/views/extra.py
Commit message: General: fix critical views that can be subject of XSS attacks

The views were returning not escaped content which is unsafe

Thanks to Daniel Elkabes who reported the issue


Vulnerable code:
                Problem(_("Can't view this page. %(reason)s") % {"reason": reason}).with_link(
                raise Problem(_("Error! Invalid command `%s`.") % command)
        raise Http404("Error! Phase with identifier `%s` not found." % requested_phase_identifier)  # pragma: no cover
    return HttpResponse("Not here yet: %s (%r, %r)" % (request.path, args, kwargs), status=410)
                yield force_text(msg)
                yield force_text(obj.args[0])
        yield force_text(obj)
    url(r"^xtheme/(?P<view>.+)/*$", extra_view_dispatch, name="xtheme_extra_view"),
    raise Problem("Error! Unknown command: `%r`" % command)
                raise Problem(_("Unknown command: `%s`.") % command)
        msg = "Error! %s/%s: Not found." % (getattr(theme, "identifier", None), view)

Fixed code:
### Fixed

- General: fix critical vulnerability on views that were returning not escaped content making it open to XSS attacks

### Changed

- Admin: hide email template button based on permission
- Reports: improve log when an importer fails

from django.utils.html import escape
                Problem(_("Can't view this page. %(reason)s") % {"reason": escape(reason)}).with_link(
from django.utils.html import escape
                raise Problem(_("Error! Invalid command `%s`.") % escape(command))
from django.utils.html import escape
        raise Http404("Error! Phase with identifier `%s` not found." % escape(requested_phase_identifier))
from django.utils.html import escape
    return HttpResponse("Not here yet: %s (%r, %r)" % (request.path, escape(args), escape(kwargs)), status=410)
from django.utils.html import escape
                yield escape(force_text(msg))
                yield escape(force_text(obj.args[0]))
        yield escape(force_text(obj))
    url(r"^xtheme/(?P<view>.+)/?$", extra_view_dispatch, name="xtheme_extra_view"),
from django.utils.html import escape
    raise Problem("Error! Unknown command: `%r`" % escape(command))
from django.utils.html import escape
                raise Problem(_("Unknown command: `%s`.") % escape(command))
from django.utils.html import escape
        msg = "Error! %s/%s: Not found." % (getattr(theme, "identifier", None), escape(view))