CVE-2019-12823 (JavaScript, published 2019-06-18T13:15Z)
Description: value: Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG-v3.md
src/web/assets/feed/dist/FeedWidget.js
src/web/assets/feed/dist/FeedWidget.min.js
src/web/assets/feed/dist/FeedWidget.min.js.map
Commit message: Fixed an XSS vulnerability


Vulnerable code:
                            var widgetHtml = '<a href="' + item.permalink + '" target="_blank">' + item.title + '</a> ';
!function(r){Craft.FeedWidget=Garnish.Base.extend({$widget:null,init:function(t,i,e){this.$widget=r("#widget"+t),this.$widget.addClass("loading");var a={url:i,limit:e};Craft.postActionRequest("dashboard/get-feed-items",a,r.proxy(function(t,i){if(this.$widget.removeClass("loading"),"success"===i){this.$widget.find("table").attr("dir",t.dir);for(var e=this.$widget.find("td"),a=0;a<t.items.length;a++){var s=t.items[a],d=r(e[a]),n='<a href="'+s.permalink+'" target="_blank">'+s.title+"</a> ";s.date&&(n+='<span class="light nowrap">'+s.date+"</span>"),d.html(n)}}},this))}})}(jQuery);
{"version":3,"sources":["FeedWidget.js"],"names":["$","Craft","FeedWidget","Garnish","Base","extend","$widget","init","widgetId","url","limit","this","addClass","data","postActionRequest","proxy","response","textStatus","removeClass","find","attr","dir","$tds","i","items","length","item","$td","widgetHtml","permalink","title","date","html","jQuery"],"mappings":"CAAA,SAAUA,GAGNC,MAAMC,WAAaC,QAAQC,KAAKC,OAC5B,CACIC,QAAS,KAETC,KAAM,SAASC,EAAUC,EAAKC,GAC1BC,KAAKL,QAAUN,EAAE,UAAYQ,GAC7BG,KAAKL,QAAQM,SAAS,WAEtB,IAAIC,EAAO,CACPJ,IAAKA,EACLC,MAAOA,GAGXT,MAAMa,kBAAkB,2BAA4BD,EAAMb,EAAEe,MAAM,SAASC,EAAUC,GAGjF,GAFAN,KAAKL,QAAQY,YAAY,WAEN,YAAfD,EAA0B,CAC1BN,KAAKL,QAAQa,KAAK,SACbC,KAAK,MAAOJ,EAASK,KAI1B,IAFA,IAAIC,EAAOX,KAAKL,QAAQa,KAAK,MAEpBI,EAAI,EAAGA,EAAIP,EAASQ,MAAMC,OAAQF,IAAK,CAC5C,IAAIG,EAAOV,EAASQ,MAAMD,GACtBI,EAAM3B,EAAEsB,EAAKC,IAEbK,EAAa,YAAcF,EAAKG,UAAY,qBAAuBH,EAAKI,MAAQ,QAEhFJ,EAAKK,OACLH,GAAc,8BAAgCF,EAAKK,KAAO,WAG9DJ,EAAIK,KAAKJ,MAIlBjB,UAvCnB,CA0CGsB","file":"FeedWidget.min.js"}

Fixed code:
### Security
- Fixed an XSS vulnerability.

                            var widgetHtml = $('<a/>', {
                                href: item.permalink,
                                target: '_blank',
                                text: item.title
                            }).html() + ' ';
!function(r){Craft.FeedWidget=Garnish.Base.extend({$widget:null,init:function(t,i,e){this.$widget=r("#widget"+t),this.$widget.addClass("loading");var a={url:i,limit:e};Craft.postActionRequest("dashboard/get-feed-items",a,r.proxy(function(t,i){if(this.$widget.removeClass("loading"),"success"===i){this.$widget.find("table").attr("dir",t.dir);for(var e=this.$widget.find("td"),a=0;a<t.items.length;a++){var s=t.items[a],d=r(e[a]),n=r("<a/>",{href:s.permalink,target:"_blank",text:s.title}).html()+" ";s.date&&(n+='<span class="light nowrap">'+s.date+"</span>"),d.html(n)}}},this))}})}(jQuery);
{"version":3,"sources":["FeedWidget.js"],"names":["$","Craft","FeedWidget","Garnish","Base","extend","$widget","init","widgetId","url","limit","this","addClass","data","postActionRequest","proxy","response","textStatus","removeClass","find","attr","dir","$tds","i","items","length","item","$td","widgetHtml","href","permalink","target","text","title","html","date","jQuery"],"mappings":"CAAA,SAAUA,GAGNC,MAAMC,WAAaC,QAAQC,KAAKC,OAC5B,CACIC,QAAS,KAETC,KAAM,SAASC,EAAUC,EAAKC,GAC1BC,KAAKL,QAAUN,EAAE,UAAYQ,GAC7BG,KAAKL,QAAQM,SAAS,WAEtB,IAAIC,EAAO,CACPJ,IAAKA,EACLC,MAAOA,GAGXT,MAAMa,kBAAkB,2BAA4BD,EAAMb,EAAEe,MAAM,SAASC,EAAUC,GAGjF,GAFAN,KAAKL,QAAQY,YAAY,WAEN,YAAfD,EAA0B,CAC1BN,KAAKL,QAAQa,KAAK,SACbC,KAAK,MAAOJ,EAASK,KAI1B,IAFA,IAAIC,EAAOX,KAAKL,QAAQa,KAAK,MAEpBI,EAAI,EAAGA,EAAIP,EAASQ,MAAMC,OAAQF,IAAK,CAC5C,IAAIG,EAAOV,EAASQ,MAAMD,GACtBI,EAAM3B,EAAEsB,EAAKC,IAEbK,EAAa5B,EAAE,OAAQ,CACvB6B,KAAMH,EAAKI,UACXC,OAAQ,SACRC,KAAMN,EAAKO,QACZC,OAAS,IAERR,EAAKS,OACLP,GAAc,8BAAgCF,EAAKS,KAAO,WAG9DR,EAAIO,KAAKN,MAIlBjB,UA3CnB,CA8CGyB","file":"FeedWidget.min.js"}