CVE-2018-25051 (HTML, published 2022-12-28T12:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clean/templates/editor.html. The manipulation of the argument article.title/content.title/article.tag leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is be1914ef0a6808e00f51618b2de92496a3604415. It is recommended to apply a patch to fix this issue. The identifier VDB-216957 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/JmPotato/Pomash
Files changed:
Pomash/libs/handler.py
Pomash/theme/clean/templates/editor.html
Pomash/theme/clean/templates/page.html
Commit message: Prevent from XSS


Vulnerable code:

from tornado.escape import to_unicode
                <input id="title" name="title" type="text" value="{% if not is_page and not new %}{{ article.title }}{% elif is_page and not new %}{{ content.title }}{% end %}" style="width:100%;">
                <input id="tag" name="tag" type="text" value="{% if not is_page and not new %}{{ article.tag }}{% end %}" style="width:100%;">
{% block title %} | {{ article.title }}{% end %}

Fixed code:
from tornado.escape import to_unicode, xhtml_escape
    def get_pure_title(self, title):
        return re.sub('''<("[^"]*"|'[^']*'|[^'">])*>''', "", title).strip()

    def escape_string(self, s):
        return xhtml_escape(s)
        
                <input id="title" name="title" type="text" value="{% if not is_page and not new %}{{ handler.escape_string(article.title) }}{% elif is_page and not new %}{{ handler.escape_string(content.title) }}{% end %}" style="width:100%;">
                <input id="tag" name="tag" type="text" value="{% if not is_page and not new %}{{ handler.escape_string(article.tag) }}{% end %}" style="width:100%;">
{% block title %} | {{ handler.get_pure_title(article.title) }}{% end %}

{% block head %}
    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.10.0/dist/katex.min.css" integrity="sha384-9eLZqc9ds8eNjO3TmqPeYcDj8n+Qfa4nuSiGYa6DjLNcv9BtN69ZIulL9+8CqC9Y" crossorigin="anonymous">
    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.10.0/dist/katex.min.js" integrity="sha384-K3vbOmF2BtaVai+Qk37uypf7VrgBubhQreNQe9aGsz9lB63dIFiQVlJbr92dw2Lx" crossorigin="anonymous"></script>
    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.10.0/dist/contrib/auto-render.min.js" integrity="sha384-kmZOZB5ObwgQnS/DuDg6TScgOiWWBiVt0plIRkZCmE6rDZGrEOQeHM5PcHi+nyqe" crossorigin="anonymous"></script>
    <script>
        document.addEventListener("DOMContentLoaded", function() {
            renderMathInElement(document.getElementById("article"), {
                delimiters: [
                    {left: "$$", right: "$$", display: true},
                    {left: "$", right: "$", display: false}
                ]
            });
        });
    </script>
{% end %}