CVE-2022-1290 (JavaScript, published 2022-04-10T16:15Z)
Description: value: Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/polonel/trudesk
Files changed:
src/helpers/utils/index.js
src/models/attachment.js
src/models/department.js
src/models/group.js
src/models/notice.js
src/models/role.js
src/models/tag.js
src/models/team.js
src/models/ticket.js
src/models/ticketpriority.js
src/models/tickettype.js
src/models/user.js
Commit message: chore(security): fix issue where html was allowed in some input fields

Vulnerable code:
var _ = require('lodash')
  this.name = this.name.trim()
  this.name = this.name.trim()
  this.normalized = this.name.trim().toLowerCase()
  this.name = this.name.trim()
  this.name = this.name.trim()
  this.name = this.name.trim()
  this.normalized = this.name.toLowerCase().trim()
  this.name = this.name.trim()
  this.normalized = this.name.toLowerCase().trim()
  this.normalized = this.name.trim().toLowerCase()
  this.name = this.name.trim()
  this.subject = this.subject.trim()
  this.name = this.name.trim()
  this.name = this.name.trim()
  user.username = user.username.toLowerCase().trim()
  user.email = user.email.trim()
  if (user.fullname) user.fullname = user.fullname.trim()
  if (user.title) user.title = user.title.trim()

Fixed code:
const _ = require('lodash')
const xss = require('xss')

module.exports.sanitizeFieldPlainText = function (text) {
  const t = xss(text, {
    whileList: {},
    stripIgnoreTag: true,
    stripIgnoreTagBody: ['script']
  })
  return t
}
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
  this.normalized = utils.sanitizeFieldPlainText(this.name.trim().toLowerCase())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
  this.message = utils.sanitizeFieldPlainText(this.message.trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
  this.normalized = utils.sanitizeFieldPlainText(this.name.toLowerCase().trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
  this.normalized = utils.sanitizeFieldPlainText(this.name.toLowerCase().trim())
var utils = require('../helpers/utils')
  this.normalized = utils.sanitizeFieldPlainText(this.name.trim().toLowerCase())
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
var utils = require('../helpers/utils')
  this.subject = utils.sanitizeFieldPlainText(this.subject.trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
var utils = require('../helpers/utils')
  this.name = utils.sanitizeFieldPlainText(this.name.trim())
const utils = require('../helpers/utils')
  user.username = utils.sanitizeFieldPlainText(user.username.toLowerCase().trim())
  user.email = utils.sanitizeFieldPlainText(user.email.trim())

  if (user.fullname) user.fullname = utils.sanitizeFieldPlainText(user.fullname.trim())
  if (user.title) user.title = utils.sanitizeFieldPlainText(user.title.trim())