Vulnerability: Improper Neutralization of Special Elements Used in a Template Engine in microweber Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Vulnerability ID: GHSA-q9qc-pp5x-mc8c
CWE: CWE-94
Severity score: 8.8
Project: https://github.com/microweber/microweber
Published: 2022-03-10
File: src/MicroweberPackages/Comment/Http/Controllers/Admin/AdminCommentController.php
Commit message: Update AdminCommentController.php
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 use MicroweberPackages\Comment\Models\Comment; use MicroweberPackages\Comment\Events\NewComment; use MicroweberPackages\Comment\Notifications\NewCommentNotification; use MicroweberPackages\User\Models\User; use MicroweberPackages\Utils\Mail\MailSender;   class AdminCommentController extends AdminController {     public function index(Request $request)     {          $contents = $this->getComments($request);           return $this->view('comment::admin.comments.index', ['contents' => $contents]);     }  public function getComments(Request $request)             $contents = $contents->filter($filter);         }           $contents = $contents->paginate($request->get('limit', 30))             ->appends($request->except('page'));  public function saveCommentEdit(Request $request)          $comment_body = $data['comment_body'];          // Claer HTML         $comment_body = $this->app->format->clean_html($comment_body);          // Clear XSS         $evil = ['(?<!\w)on\w*', 'xmlns', 'formaction', 'xlink:href', 'FSCommand', 'seekSegmentTime'];         $comment_body = $this->app->format->clean_xss($comment_body, true, $evil, 'removeEvilAttributes');          if (!empty($comment_body) and !empty($data['format']) and $data['format'] == 'markdown') {             $comment_body = Markdown::convertToHtml($comment_body);

Fixed version (after fix):
 use MicroweberPackages\Comment\Models\Comment; use MicroweberPackages\Comment\Events\NewComment; use MicroweberPackages\Comment\Notifications\NewCommentNotification; use MicroweberPackages\Helper\HTMLClean; use MicroweberPackages\User\Models\User; use MicroweberPackages\Utils\Mail\MailSender;  class AdminCommentController extends AdminController {     public function index(Request $request)     {         $contents = $this->getComments($request);          return $this->view('comment::admin.comments.index', ['contents' => $contents]);     }  public function getComments(Request $request)             $contents = $contents->filter($filter);         }          $contents = $contents->paginate($request->get('limit', 30))             ->appends($request->except('page'));  public function saveCommentEdit(Request $request)          $comment_body = $data['comment_body'];          $cleanHtml = new HTMLClean();         $comment_body = $cleanHtml->onlyTags($comment_body);          if (!empty($comment_body) and !empty($data['format']) and $data['format'] == 'markdown') {             $comment_body = Markdown::convertToHtml($comment_body);

Patch:
patch: @@ -18,18 +18,16 @@
 use MicroweberPackages\Comment\Models\Comment;
 use MicroweberPackages\Comment\Events\NewComment;
 use MicroweberPackages\Comment\Notifications\NewCommentNotification;
+use MicroweberPackages\Helper\HTMLClean;
 use MicroweberPackages\User\Models\User;
 use MicroweberPackages\Utils\Mail\MailSender;
 
-
 class AdminCommentController extends AdminController
 {
     public function index(Request $request)
     {
-
         $contents = $this->getComments($request);
 
-
         return $this->view('comment::admin.comments.index', ['contents' => $contents]);
     }
 
@@ -42,7 +40,6 @@ public function getComments(Request $request)
             $contents = $contents->filter($filter);
         }
 
-
         $contents = $contents->paginate($request->get('limit', 30))
             ->appends($request->except('page'));
 
@@ -148,12 +145,8 @@ public function saveCommentEdit(Request $request)
 
         $comment_body = $data['comment_body'];
 
-        // Claer HTML
-        $comment_body = $this->app->format->clean_html($comment_body);
-
-        // Clear XSS
-        $evil = ['(?<!\w)on\w*', 'xmlns', 'formaction', 'xlink:href', 'FSCommand', 'seekSegmentTime'];
-        $comment_body = $this->app->format->clean_xss($comment_body, true, $evil, 'removeEvilAttributes');
+        $cleanHtml = new HTMLClean();
+        $comment_body = $cleanHtml->onlyTags($comment_body);
 
         if (!empty($comment_body) and !empty($data['format']) and $data['format'] == 'markdown') {
             $comment_body = Markdown::convertToHtml($comment_body);
path: src/MicroweberPackages/Comment/Http/Controllers/Admin/AdminCommentController.php