Vulnerability: Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Vulnerability ID: CVE-2015-5282
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/theforeman/foreman
Published: 2017-09-25
File: app/assets/javascripts/hidden_values.js
Commit message: Fixes #11859 - handle HTML in parameters safely when hiding values (CVE-2015-5282)
Commit author: Shlomi Zadok

Vulnerable version (before fix):
 function turn_textarea_switch(checkbox) {   var $editorContainer = $('.editor-container');    if (checkbox.checked) {     target = '<input class="form-control" type="password" id="' + id + '" name="' + source.name + '" value ="' + source.value + '"></input>'     $editorContainer.find('.navbar').hide();     $editorContainer.find('.ace_editor').remove();     $(source).replaceWith(target);   } else if ($('.editor-container').length > 0) {     target = '<textarea class="form-control editor_source hide" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'     $editorContainer.find('.navbar').show();     $(source).replaceWith(target);      onEditorLoad();     session = Editor.getSession();     session.setValue($(source).val());   } else {     var target = '<textarea class="form-control" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'     $(source).replaceWith(target);   } }

Fixed version (after fix):
 function turn_textarea_switch(checkbox) {   var $editorContainer = $('.editor-container');    if (checkbox.checked) {     target = $('<input/>').attr({ type: 'password', id: id, name: source.name, value: $(source).val(), class: 'form-control'});     $editorContainer.find('.navbar').hide();     $editorContainer.find('.ace_editor').remove();     $(source).replaceWith(target);   } else if ($('.editor-container').length > 0) {     target = $('<textarea/>').attr({class: 'form-control editor_source hide', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});     $editorContainer.find('.navbar').show();     $(source).replaceWith(target);      onEditorLoad();     session = Editor.getSession();     session.setValue($(source).val());   } else {     var target = $('<textarea/>').attr({class: 'form-control', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});     $(source).replaceWith(target);   } }

Patch:
patch: @@ -5,20 +5,20 @@ function turn_textarea_switch(checkbox) {
   var $editorContainer = $('.editor-container');
 
   if (checkbox.checked) {
-    target = '<input class="form-control" type="password" id="' + id + '" name="' + source.name + '" value ="' + source.value + '"></input>'
+    target = $('<input/>').attr({ type: 'password', id: id, name: source.name, value: $(source).val(), class: 'form-control'});
     $editorContainer.find('.navbar').hide();
     $editorContainer.find('.ace_editor').remove();
     $(source).replaceWith(target);
   } else if ($('.editor-container').length > 0) {
-    target = '<textarea class="form-control editor_source hide" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
+    target = $('<textarea/>').attr({class: 'form-control editor_source hide', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});
     $editorContainer.find('.navbar').show();
     $(source).replaceWith(target);
 
     onEditorLoad();
     session = Editor.getSession();
     session.setValue($(source).val());
   } else {
-    var target = '<textarea class="form-control" id="' + id + '" name="' + source.name + '" placeholder="Value" rows="1">' + source.value + '</textarea>'
+    var target = $('<textarea/>').attr({class: 'form-control', id: id, name: source.name, placeholder: 'Value', rows: 1, value: $(source).val()});
     $(source).replaceWith(target);
   }
 }
path: app/assets/javascripts/hidden_values.js