CVE-2023-5556 (Other, published 2023-10-12T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/structurizr/onpremises
Files changed:
structurizr-onpremises/src/main/webapp/WEB-INF/views/workspace-summary.jsp
Commit message: XSS prevention.


Vulnerable code:
                <span class="label label-version"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/clock-history.svg" class="icon-xs icon-white" /> ${workspace.internalVersion}</span>
                <a href="${urlPrefix}/dsl${urlSuffix}"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/code-slash.svg" class="icon-sm" /> DSL editor</a>
            <a href="${urlPrefix}/diagrams${urlSuffix}"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/bounding-box.svg" class="icon-sm" /> Diagrams</a>
                <a href="${urlPrefix}/documentation${urlSuffix}"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/book.svg" class="icon-sm" /> Documentation</a>
                <a href="${urlPrefix}/decisions${urlSuffix}"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/journal-text.svg" class="icon-sm" /> Decisions</a>
                <a href="${urlPrefix}/explore${urlSuffix}"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/diagram-3.svg" class="icon-sm" /> Explore</a>
                <a href="${urlPrefix}/theme${urlSuffix}" target="_blank"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/palette.svg" class="icon-sm" /> Theme</a>
                <a href="${urlPrefix}/images"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/filetype-png.svg" class="icon-sm" /> Published images</a>
                <a href="${urlPrefix}/settings"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/gear.svg" class="icon-sm" /> Settings</a>
                <a href="${urlPrefix}/users"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/people.svg" class="icon-sm" /> Users</a>
                    <form class="form-inline" style="display: inline-block" method="get" action="${urlPrefix}">
                        <button id="revertButton" class="btn btn-default small"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/clock-history.svg" class="icon-btn" /> Revert to ${workspace.internalVersion}</button>
                                    <a href="${urlPrefix}/dsl"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/code-slash.svg" class="icon-lg"/> DSL editor</a>
                                    <a href="${urlPrefix}/settings#api"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/gear.svg" class="icon-lg" /> Settings</a>
    $('#workspaceVersion').val("${workspace.internalVersion}");
                var url = '${urlPrefix}/diagrams${urlSuffix}#' + structurizr.util.escapeHtml(view.key);
                html += '<div class="small"><a href="${urlPrefix}/diagrams${urlSuffix}">More diagrams...</a></div>';

Fixed code:
                <span class="label label-version"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/clock-history.svg" class="icon-xs icon-white" /> <c:out value="${workspace.internalVersion}" /></span>
                <a href="<c:out value="${urlPrefix}" />/dsl<c:out value="${urlSuffix}" />"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/code-slash.svg" class="icon-sm" /> DSL editor</a>
            <a href="<c:out value="${urlPrefix}" />/diagrams<c:out value="${urlSuffix}" />"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/bounding-box.svg" class="icon-sm" /> Diagrams</a>
                <a href="<c:out value="${urlPrefix}" />/documentation<c:out value="${urlSuffix}" />"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/book.svg" class="icon-sm" /> Documentation</a>
                <a href="<c:out value="${urlPrefix}" />/decisions<c:out value="${urlSuffix}" />"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/journal-text.svg" class="icon-sm" /> Decisions</a>
                <a href="<c:out value="${urlPrefix}" />/explore<c:out value="${urlSuffix}" />"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/diagram-3.svg" class="icon-sm" /> Explore</a>
                <a href="<c:out value="${urlPrefix}" />/theme<c:out value="${urlSuffix}" />" target="_blank"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/palette.svg" class="icon-sm" /> Theme</a>
                <a href="<c:out value="${urlPrefix}" />/images"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/filetype-png.svg" class="icon-sm" /> Published images</a>
                <a href="<c:out value="${urlPrefix}" />/settings"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/gear.svg" class="icon-sm" /> Settings</a>
                <a href="<c:out value="${urlPrefix}" />/users"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/people.svg" class="icon-sm" /> Users</a>
                    <form class="form-inline" style="display: inline-block" method="get" action="<c:out value="${urlPrefix}" />">
                        <button id="revertButton" class="btn btn-default small"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/clock-history.svg" class="icon-btn" /> Revert to <c:out value="${workspace.internalVersion}" /></button>
                                    <a href="<c:out value="${urlPrefix}" />/dsl"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/code-slash.svg" class="icon-lg"/> DSL editor</a>
                                    <a href="<c:out value="${urlPrefix}" />/settings#api"><img src="${structurizrConfiguration.cdnUrl}/bootstrap-icons/gear.svg" class="icon-lg" /> Settings</a>
    $('#workspaceVersion').val("<c:out value="${workspace.internalVersion}" />");
                var url = '<c:out value="${urlPrefix}" />/diagrams<c:out value="${urlSuffix}" />#' + structurizr.util.escapeHtml(view.key);
                html += '<div class="small"><a href="<c:out value="${urlPrefix}" />/diagrams<c:out value="${urlSuffix}" />">More diagrams...</a></div>';