Vulnerability: Cross-site Scripting in django-helpdesk django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability ID: GHSA-vx6v-xg64-pmr8
CWE: CWE-79
Severity score: 8.8
Project: https://github.com/django-helpdesk/django-helpdesk
Published: 2021-11-15
File: helpdesk/templates/helpdesk/ticket_list.html
Commit message: Add function `htmlEntities`

`htmlentities()` is a function which converts special characters. This allows you to show to display the string without the browser reading it as HTML.
Commit author: lethanhphuc

Vulnerable version (before fix):
 <h5 class="mb-0">         function get_url(row) {             return "{% url 'helpdesk:view' 1234 %}".replace(/1234/, row.id.toString());         }          $(document).ready(function () {             // Ticket DataTable Initialization             $('#ticketTable').DataTable({ <h5 class="mb-0">                             if (type === 'display') {                                 data = '<div class="tickettitle"><a href="' + get_url(row) + '" >' +                                     row.id + '. ' +                                     row.title + '</a></div>';                             }                             return data                         }

Fixed version (after fix):
 <h5 class="mb-0">         function get_url(row) {             return "{% url 'helpdesk:view' 1234 %}".replace(/1234/, row.id.toString());         }                  function htmlEntities(str) {             return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');         }                  $(document).ready(function () {             // Ticket DataTable Initialization             $('#ticketTable').DataTable({ <h5 class="mb-0">                             if (type === 'display') {                                 data = '<div class="tickettitle"><a href="' + get_url(row) + '" >' +                                     row.id + '. ' +                                     htmlEntities(row.title) + '</a></div>';                             }                             return data                         }

Patch:
patch: @@ -330,7 +330,11 @@ <h5 class="mb-0">
         function get_url(row) {
             return "{% url 'helpdesk:view' 1234 %}".replace(/1234/, row.id.toString());
         }
-
+        
+        function htmlEntities(str) {
+            return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+        }
+        
         $(document).ready(function () {
             // Ticket DataTable Initialization
             $('#ticketTable').DataTable({
@@ -366,7 +370,7 @@ <h5 class="mb-0">
                             if (type === 'display') {
                                 data = '<div class="tickettitle"><a href="' + get_url(row) + '" >' +
                                     row.id + '. ' +
-                                    row.title + '</a></div>';
+                                    htmlEntities(row.title) + '</a></div>';
                             }
                             return data
                         }
path: helpdesk/templates/helpdesk/ticket_list.html