CVE-2023-3142 (PHP, published 2023-06-07T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Content/ContentManagerHelpers.php
src/MicroweberPackages/Content/tests/ContentApiControllerLiveEditSaveTest.php
src/MicroweberPackages/Database/DatabaseManager.php
src/MicroweberPackages/Module/Models/Module.php
Commit message: update


Vulnerable code:
use Illuminate\Database\Eloquent\Model;
use MicroweberPackages\Category\Models\Category;




           $html =  preg_replace('/<[^\/>]*>([\s]?)*<\/[^>]*>/', '', $html);
             // remove code tags




             if (empty(trim($string))) {

           $this->assertNotEquals($contentFieldHtml1, $contentFieldHtml2);


                    if(trim($string) == ''){
      foreach ($htmlsChunks as $k => $htmlChunk) {

          $html = implode('--------chunk-------', $htmlChunk);
         $contentFieldHtml = $html;
           // $contentFieldHtml = str_replace('{SITE_URL}', site_url(), $contentFieldHtml);

       }
    private function cleanupAndPrepare(){
        $text = str_ireplace('{SITE_URL}','___mw-site-url-temp-replace-on-clean___', $text);
        foreach($pq->find('a') as $stuffs)
        {
            if($href){
            pq($stuffs)->attr('href', str_replace(' ', '%20', $href));
        $text = str_ireplace('___mw-site-url-temp-replace-on-clean___','{SITE_URL}',     $text);
            $id_to_return = $this->table($table_assoc_name)->insert($criteria);
                $insert_or_update = 'insert';
              //  $model = new Content($params);
                 $model = app()->make(Content::class);
        $icon = str_replace( '{SITE_URL}', '', $this->icon);
        if (get_file_extension($icon) == 'svg') {
            $content =  file_get_contents($icon);
            $content = str_replace('<?xml version="1.0" encoding="utf-8"?>', '', $content);
            return $content;
        } else {
            return '<img src="' . $icon . '" />';

Fixed code:
            $ref_page_url = xss_clean($ref_page_url);
            $html = preg_replace('/<[^\/>]*>([\s]?)*<\/[^>]*>/', '', $html);
            // remove code tags
            if (empty(trim($string))) {
            $this->assertNotEquals($contentFieldHtml1, $contentFieldHtml2);
                    if (trim($string) == '') {
        foreach ($htmlsChunks as $k => $htmlChunk) {
            $html = implode('--------chunk-------', $htmlChunk);
            $contentFieldHtml = $html;
            // $contentFieldHtml = str_replace('{SITE_URL}', site_url(), $contentFieldHtml);
        }


    }


    public function testSaveContentXssSpaceInUrlAttribute()
    {

        $this->cleanupAndPrepare();
        $unique = uniqid('testSaveContentXssInUrlAttribute');
        $newCleanPage = save_content([
            'subtype' => 'static',
            'content_type' => 'page',
            'layout_file' => 'clean.php',
            'title' => 'testSaveContentXssInUrlAttribute-save' . $unique,
            'preview_layout_file' => 'clean.php',
            'url' => 'url with space ' . $unique . '  <script>alert(1)</script>',
            'is_active' => 1,
        ]);

        $findPage = Page::whereId($newCleanPage)->first();
        $this->assertEquals($findPage->url, 'url-with-space-' . strtolower($unique));

    private function cleanupAndPrepare()
    {
        $text = str_ireplace('{SITE_URL}', '___mw-site-url-temp-replace-on-clean___', $text);
        foreach ($pq->find('a') as $stuffs) {
            if ($href) {
                pq($stuffs)->attr('href', str_replace(' ', '%20', $href));
        $text = str_ireplace('___mw-site-url-temp-replace-on-clean___', '{SITE_URL}', $text);

            if(method_exists($this->table($table),'create')){
                $id_to_return = $this->table($table)->create($criteria);
            } else {
                $id_to_return = $this->table($table)->insert($criteria);
            }
             //$id_to_return = $this->table($table_assoc_name)->insert($criteria);
         //   $id_to_return = $this->table($table_assoc_name)->create($criteria);

              $insert_or_update = 'insert';
              if(method_exists($this->table($table),'create')){
                    $insert_or_update = 'create';
              }
          //  $insert_or_update = 'create';




                 $model = new Content($params);
              //   $model = app()->make(Content::class);
        $icon = str_replace('{SITE_URL}', '', $this->icon);
        if (file_exists($icon)) {
            if (get_file_extension($icon) == 'svg') {
                $content = file_get_contents($icon);
                $content = str_replace('<?xml version="1.0" encoding="utf-8"?>', '', $content);
                return $content;
            } else {
                return '<img src="' . $icon . '" />';
            }