CVE-2018-25053 (JavaScript, published 2022-12-28T12:15Z)
Description: value: A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216959.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/moappi/json2html
Files changed:
README.md
json2html.js
package.json
test/index.html
test/test.text.js
Commit message: Added Text Attribute

To help combat XSS attackes the text attribute will add text only to elements rather than html


Vulnerable code:
	{"<>": "span", "html": "${name} (${year})"}
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
 <head>
	<title> json2html examples </title>

	<!-- Add JSON2HTML -->
	<script type="text/javascript" src="../json2html.js"></script>
	
 </head>
 <body>
	<!-- Run the tests -->
	<script type="text/javascript" src="example.nested.js"></script>
	<script type="text/javascript" src="example.shorthand.js"></script>
	<script type="text/javascript" src="example.escape.js"></script>
 </body>
</html>
//Copyright (c) 2016 Crystalline Technologies
						//LEGACY support for tag
						//LEGACY support for children

								//Determine what type of object was returned
								switch(typeof temp){

									//Only returned by json2html.transform or $.json2html calls
									case 'object':
										//make sure this object is a valid json2html response object
										// we ignore all other objects (since we don't know how to represent them in html)
										if(temp.html !== undefined && temp.events !== undefined) children = json2html._append(children,temp);
									break;
									
									//Not supported
									case 'function':
									case 'undefined':
									break; 

									//Append to html
									// string, number, boolean
									default:
										children.html += temp;
									break;
								}
								//Create the html attribute for this element
  "version": "1.0.1",

Fixed code:
	{"<>": "span", "text": "${name} (${year})"}
//Copyright (c) 2018 Crystalline Technologies
						//DEPRECATED (use <> instead)

						//HTML element to render
						
						//Encode as text
						case 'text':
							//Get the transform value associated with this key
							var _transform = transform[key];
							
							//Determine what kind of object this is
							// array => NOT SUPPORTED
							// other => text
							if(json2html._isArray(_transform)) {
                                //NOT Supported
							} else if(typeof _transform === 'function') {
								
								//Get the result from the function
								var temp = _transform.call(obj, obj, index);
								
								//Don't allow arrays as return objects from functions
    							if(!json2html._isArray(temp)) {

    								//Determine what type of object was returned
    								switch(typeof temp){
                                    
    									//Not supported for text
    									case 'function':
    									case 'undefined':
    									case 'object':
    									break; 
    									
    									//Append as text
    									// string, number, boolean
    									default:
    										//Insure we encode as text first
    										children.html += json2html.toText(temp);
    									break;
    								}
    							}
							} else {
								
								//Get the encoded text associated with this element
								html = json2html.toText( json2html._getValue(obj,transform,key,index) );
							}
						break;
						//DEPRECATED (use HTML instead)

						//Encode as HTML
						// accepts Array of children, functions, string, number, boolean
                                
                                //Don't allow arrays as return objects from functions
                                if(!json2html._isArray(temp)) {
                                    
    								//Determine what type of object was returned
    								switch(typeof temp){
    
    									//Only returned by json2html.transform or $.json2html calls
    									case 'object':
    										//make sure this object is a valid json2html response object
    										// we ignore all other objects (since we don't know how to represent them in html)
    										if(temp.html !== undefined && temp.events !== undefined) children = json2html._append(children,temp);
    									break;
    									
    									//Not supported
    									case 'function':
    									case 'undefined':
    									break; 
    
    									//Append to html
    									// string, number, boolean
    									default:
    										children.html += temp;
    									break;
    								}
                                }
								//Get the HTML associated with this element

	//Encode the html to text
	'toText':function(html) {
		return html
			.replace(/&/g, '&amp;')
			.replace(/</g, '&lt;')
			.replace(/>/g, '&gt;')
			.replace(/\"/g, '&quot;')
			.replace(/\'/g, '&#39;')
			.replace(/\//g, '&#x2F;');
	},
  "version": "1.1.0",
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
 <head>
	<title> json2html tests </title>

	<!-- Add JSON2HTML -->
	<script type="text/javascript" src="../json2html.js"></script>
	
 </head>
 <body>
	<!-- Run the tests -->
	<script type="text/javascript" src="test.nested.js"></script>
	<script type="text/javascript" src="test.shorthand.js"></script>
	<script type="text/javascript" src="test.escape.js"></script>
	<script type="text/javascript" src="test.text.js"></script>
 </body>
</html>

(function() {
    
	//Test the handling of quoted strings 
    var test_data = [
		{"text":"<script>alert(0);</script> no alert"},
		{"text":"<strong>non highlighted</strong>"},
		{"text":"& (ampersand) : ' (single quote) : \" (double quote) "}
	];

    var transform = [
        {"<>":"div", "text":"${text}"},
        {"<>":"div","text":[
            {"<>":"span","text":"this shouldn't be rendered"}
        ]},
        {"<>":"div", "text":function(){
            return(this.text);
        }},
        {"<>":"div", "text":function(){
            return(["not rendered"]);
        }}
    ];
        
    var html = json2html.transform(test_data, transform);

    document.write('<h1>Text Encoding Test</h1>'+ html);
})();