CVE-2015-10021 (JavaScript, published 2023-01-07T12:15Z)
Description: value: A vulnerability was found in ritterim definely. It has been classified as problematic. Affected is an unknown function of the file src/database.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is b31a022ba4d8d17148445a13ebb5a42ad593dbaa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217608.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ritterim/definely
Files changed:
gulpfile.js
src/database.js
src/sanitize.js
src/sanitizeTests.js
Commit message: Fix XSS on term-detailed web client view.
Previous behavior would render unencoded HTML in the view based on the term's definition-data.
New behavior encodes HTML-tags in the DB-module via a separate sanitize module.
However, be aware this functionality should be called prior to any markdown-related conversion in the future.
Otherwise, the resulting HTML will be encoded.
Related to https://github.com/ritterim/definely/issues/49.

Also added a new gulp task for running TDD-style tests.
And, incorporated this into the existing test-task.


Vulnerable code:

gulp.task('test', ['build'], function () {
    return gulp.src('build/**/*Spec.js', {
            read: false
        })
        .pipe($.mocha({
            reporter: 'nyan'
        }))
})

gulp.task('test', ['build'], function () {
                        term = new Term(row.id, row.term, row.definition, row.tags || undefined)
                    var terms = result.rows.map(row => new Term(row.id, row.term, row.definition, row.tags || undefined))
                        var terms = result.rows.map(row => new Term(row.id, row.term, row.definition, row.tags || undefined))

Fixed code:
gulp.task('test', ['build', 'tdd-tests'], function () {
gulp.task('tdd-tests', ['build'], function() {
    return gulp.src('build/**/*Tests.js', {
        read: false
    }).pipe($.mocha({
        ui: 'tdd'
    }));
})

import Sanitize from './sanitize'
        this.sanitize = new Sanitize();
        var self = this;

                        term = new Term(row.id, row.term, self.sanitize.htmlSanitize(row.definition), row.tags || undefined)
        var self = this;

                    var terms = result.rows.map(row => new Term(row.id, row.term, self.sanitize.htmlSanitize(row.definition), row.tags || undefined))
                        var terms = result.rows.map(row => new Term(row.id, row.term, self.sanitize.htmlSanitize(row.definition), row.tags || undefined))
export default class Sanitize {
    constructor() {
    }

    /**
     * This function replaces all instances of lt and gt with their
     * HTML entity.
     */
    htmlSanitize(html) {
        html = html.replace(/</g, '&lt;');
        html = html.replace(/>/g, '&gt;');

        return html;
    }
}
import assert from 'assert'
import sut from './sanitize'

suite('Sanitize', function() {
    suite('#htmlSanitize()', function() {
        test('should encode all lt and gt-symbols', function() {
            var result = new sut()
                .htmlSanitize('<test></test>');

            assert.equal('&lt;test&gt;&lt;/test&gt;', result);
        });
    });
});