CVE-2016-15008 (JavaScript, published 2023-01-04T10:15Z)
Description: value: A vulnerability was found in oxguy3 coebot-www and classified as problematic. This issue affects the function displayChannelCommands/displayChannelQuotes/displayChannelAutoreplies/showChannelHighlights/showChannelBoir of the file js/channel.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named c1a6c44092585da4236237e0e7da94ee2996a0ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217355.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/oxguy3/coebot-www
Files changed:
js/channel.js
js/common.js
Commit message: fixed XSS injection vulns on channel.php


Vulnerable code:
        row += '<td class="should-be-linkified should-be-emotified">' + prettifyStringVariables(cmd.value) + '</td>';
        row += '<td>' + quote.quote + '</td>';
        row += '<td>' + prettifyStringVariables(reply.response) + '</td>';
        row += '<td><span class="fake-link js-highlight-btn" data-hlid="' + strm.id + '">' + strm.title + '</span></td>';
    html += '<div class="boir-character"><strong>Character:</strong> ' + channelBoirData.character + "</div>";
    html += '<div class="boir-floor"><strong>Floor:</strong> ' + channelBoirData.floor + "</div>";
    html += '<div class="boir-seed"><strong>Seed:</strong> ' + channelBoirData.seed + "</div>";
        html += '<input type="text" class="dial js-boir-dial js-boir-dial-fly" value="' + channelBoirData.flyProgress + '">';
            html += '<li class="list-group-item">' + item + '</li>';
        html += '<input type="text" class="dial js-boir-dial js-boir-dial-guppy" value="' + channelBoirData.guppyProgress + '">';
            html += '<li class="list-group-item">' + item + '</li>';
    $(".command").prepend('<span class="command-prefix">' + channelData.commandPrefix + '</span>');
            
            
}

Fixed code:
        row += '<td class="should-be-linkified should-be-emotified">' + prettifyStringVariables(cleanHtmlText(cmd.value)) + '</td>';
        row += '<td>' + cleanHtmlText(quote.quote) + '</td>';
        row += '<td>' + prettifyStringVariables(cleanHtmlText(reply.response)) + '</td>';
        row += '<td><span class="fake-link js-highlight-btn" data-hlid="' + strm.id + '">' + cleanHtmlText(strm.title) + '</span></td>';
    html += '<div class="boir-character"><strong>Character:</strong> ' + cleanHtmlText(channelBoirData.character) + "</div>";
    html += '<div class="boir-floor"><strong>Floor:</strong> ' + cleanHtmlText(channelBoirData.floor) + "</div>";
    html += '<div class="boir-seed"><strong>Seed:</strong> ' + cleanHtmlText(channelBoirData.seed) + "</div>";
        html += '<input type="text" class="dial js-boir-dial js-boir-dial-fly" value="' + cleanHtmlAttr(channelBoirData.flyProgress) + '">';
            html += '<li class="list-group-item">' + cleanHtmlText(item) + '</li>';
        html += '<input type="text" class="dial js-boir-dial js-boir-dial-guppy" value="' + cleanHtmlAttr(channelBoirData.guppyProgress) + '">';
            html += '<li class="list-group-item">' + cleanHtmlText(item) + '</li>';
	return true; //temporary disable
    $(".command").prepend('<span class="command-prefix">' + cleanHtmlText(channelData.commandPrefix) + '</span>');
var cleanHtmlTextMap = {
   "&": "&amp;",
   "<": "&lt;",
   ">": "&gt;",
   '"': '&quot;',
   "'": '&#39;',
   "/": '&#x2F;'
 };

 function cleanHtmlText(string) {
    return String(string).replace(/[&<>"'\/]/g, function (s) {
        return cleanHtmlTextMap[s];
    });
 }


}