CVE-2015-10089 (JavaScript, published 2023-03-05T14:15Z)
Description: value: A vulnerability classified as problematic has been found in flame.js. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named e6c49b5f6179e31a534b7c3264e1d36aa99728ac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222291.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flamejs/flame.js
Files changed:
utils/string_measurement.js
views/checkbox_view.js
views/menu_view.js
views/table_data_view.js
views/table_view.js
Commit message: XSS fixes:
-Patch render calls in CheckboxView, TableView and TableDataView to display escaped content; preserve <br> tags in table headers in TableView
-Escape the innerHTML call in string_measurement.js
-Escape element.html call when selecting read-only content in TableDataView


Vulnerable code:
    measureString: function(string, parentClasses, elementClasses, additionalStyles) {
        element.innerHTML = string;
        buffer.push(Ember.isNone(this.get('title')) ? '' : this.get('title'));
        var allTitles = items.reduce(function(currentTitles, item) {
            var nextTitle = Ember.get(item, itemTitleKey);
            return currentTitles + nextTitle + '<br>';
        }, '');
            var readOnlyValue = owner.editableValue(dataCell, true);
                    titleValue = (cell.titleValue && cell.titleValue() ? 'title="%@"'.fmt(cell.titleValue()) : '');
            buffer.push('<div class="panel-title">%@</div>'.fmt(this.get('content.title')));


Fixed code:
    measureString: function(stringOrArray, parentClasses, elementClasses, additionalStyles) {
        var escape = Handlebars.Utils.escapeExpression;
        var measuredString;
        // We also accept an array of strings and then return the width of the longest one by joining them with <br>.
        if (Ember.isArray(stringOrArray)) {
            measuredString = stringOrArray.reduce(function(currentStrings, nextString) {
                        return currentStrings + escape(nextString) + '<br>';
                    }, '');
        } else {
            measuredString = escape(stringOrArray);
        }
        element.innerHTML = measuredString;
        buffer.push(Ember.isNone(this.get('title')) ? '' : Handlebars.Utils.escapeExpression(this.get('title')));
        var allTitles = items.map(function(currentTitles, item) { Ember.get(item, itemTitleKey); });
            var readOnlyValue = Handlebars.Utils.escapeExpression(owner.editableValue(dataCell, true));
        var escape = Handlebars.Utils.escapeExpression;
                    } else {
                        // Escape the cell content unless there is a deliberate implementation for cells with HTML content.
                        content = escape(content);
                    titleValue = (cell.titleValue && cell.titleValue() ? 'title="%@"'.fmt(escape(cell.titleValue())) : '');
            buffer.push('<div class="panel-title">%@</div>'.fmt(Handlebars.Utils.escapeExpression(this.get('content.title'))));
            // We have to support <br> for row headers, so we'll replace them back after escaping
            headerLabel = Ember.Handlebars.Utils.escapeExpression(headerLabel).replace(/&lt;br&gt;/g, '<br>');