CVE-2022-2026 (JavaScript, published 2022-06-09T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kromitgmbh/titra
Files changed:
.meteor/release
.meteor/versions
imports/ui/components/allprojectschart.js
imports/ui/components/dailytimetable.js
imports/ui/components/detailtimetable.js
imports/ui/components/periodtimetable.js
imports/ui/components/projectAccessRights.js
imports/ui/components/projectchart.js
imports/ui/pages/dashboard.js
imports/utils/frontend_helpers.js
imports/utils/server_method_helpers.js
package-lock.json
package.json
Commit message: 🔒 fixes three critical stored XSS vulnerabilities thanks @saharshtapi for reporting this
🔒 fixes a formula injection vulnerability in the Excel export functionality thanks @saharshtapi for reprorting this
❗️this is an important security release, we recommend to migrate asap, all titra versions below version 0.77.0 are considered insecure for production use


Vulnerable code:
METEOR@2.7.2
tunguska:reactive-aggregate@1.3.7
                labels: templateInstance.topTasks.get().map((task) => task._id),
        { name: t('globals.project'), editable: false, width: 2 },
        { name: t('globals.resource'), editable: false, width: 2 },
    entry.task,
        { name: t('globals.project'), editable: false },
        { name: t('globals.resource'), editable: false },
  validateEmail, getGlobalSetting, showToast,
                  labels: templateInstance.topTasks.get().map((task) => task._id),
              timecard.task.replace(/(:\S*:)/g, emojify),
    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title="${value}">${value}</span>`
    userId: projectUsers.findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
      "version": "1.11.2",
      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.2.tgz",
      "integrity": "sha512-F4LXf1OeU9hrSYRPTTj/6FbO4HTjPKXvEIC1P2kcnFurViINCVk3ZV0xAS3XVx9MkMsXbbqlK6hjseaYbgKEHw=="
      "version": "8.16.0",
      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.16.0.tgz",
      "integrity": "sha512-MBndsoXY/PeVTDJeWsYj7kLZ5hQpJOfMYLsF6LicLHQWbRDG19lK5jOix4DPl8yY4SUFcE3txy86OzFLWT+yoA==",
      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
  "version": "0.76.1",
    "dayjs": "^1.11.2",
    "eslint": "^8.16.0",

Fixed code:
METEOR@2.7.3
tunguska:reactive-aggregate@1.3.8
                labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
  addToolTipToTableCell,
        {
          name: t('globals.project'),
          editable: false,
          width: 2,
          format: addToolTipToTableCell,
        },
        {
          name: t('globals.resource'),
          editable: false,
          width: 2,
          format: addToolTipToTableCell,
        },
    entry.task.replace(/^=/, '='),
  addToolTipToTableCell,
        { name: t('globals.project'), editable: false, format: addToolTipToTableCell },
        { name: t('globals.resource'), editable: false, format: addToolTipToTableCell },
  validateEmail, getGlobalSetting, showToast, addToolTipToTableCell,
          format: addToolTipToTableCell,
                  labels: templateInstance.topTasks.get().map((task) => $('<span>').text(task._id).html()),
  addToolTipToTableCell,
              $('<span>').text(timecard.task.replace(/(:\S*:)/g, emojify)).html(),
    const sanitizedValue = $('<div/>').text(value).html()
    return `<span class="js-tooltip" data-bs-toggle="tooltip" data-bs-placement="left" title='${sanitizedValue}'>${sanitizedValue}</span>`
    userId: projectUsers
      .findOne().users.find((elem) => elem._id === entry._id.userId)?.profile?.name,
      "version": "1.11.3",
      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.3.tgz",
      "integrity": "sha512-xxwlswWOlGhzgQ4TKzASQkUhqERI3egRNqgV4ScR8wlANA/A9tZ7miXa44vTTKEq5l7vWoL5G57bG3zA+Kow0A=="
      "version": "8.17.0",
      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.17.0.tgz",
      "integrity": "sha512-gq0m0BTJfci60Fz4nczYxNAlED+sMcihltndR8t9t1evnU/azx53x3t2UHXC/uRjcbvRw/XctpaNygSTcQD+Iw==",
      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
  "version": "0.77.0",
    "dayjs": "^1.11.3",
    "eslint": "^8.17.0",