Vulnerability: Cross-site Scripting in FacturaScripts FacturaScripts versions 2022.06 and prior are vulnerable to reflected cross-site scripting attacks. This vulnerability can use arbitrarily executed javascript code to steal users' cookies, perform HTTP request, get content of `same origin` page, etc. A fix is available on the `master` branch of the GitHub repository and anticipated to be part of version 2022.07.
Vulnerability ID: GHSA-m8gv-gvhf-7rhp
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/neorazorx/facturascripts
Published: 2022-05-05
File: Core/Model/Subcuenta.php
Commit message: Escaped html code from model fields to improve security.
------
Escapado el html de los campos del modelo para mejorar la seguridad.
Commit author: Carlos Garcia Gomez

Vulnerable version (before fix):
 public function test(): bool     {         $this->saldo = $this->debe - $this->haber;          $this->codcuenta = trim($this->codcuenta);         $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : trim($this->codsubcuenta);         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);         if (strlen($this->descripcion) < 1 || strlen($this->descripcion) > 255) {             $this->toolBox()->i18nLog()->warning( public function test(): bool          // check exercise         $exercise = $this->getExercise();         if (!$this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {             $this->toolBox()->i18nLog()->warning('account-length-error', ['%code%' => $this->codsubcuenta]);             return false;         }

Fixed version (after fix):
 public function test(): bool     {         $this->saldo = $this->debe - $this->haber;          // escape html         foreach (['codcuenta', 'codsubcuenta', 'descripcion', 'codcuentaesp'] as $field) {             $this->{$field} = self::toolBox()::utils()::noHtml($this->{$field});         }          $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : $this->codsubcuenta;         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);         if (strlen($this->descripcion) < 1 || strlen($this->descripcion) > 255) {             $this->toolBox()->i18nLog()->warning( public function test(): bool          // check exercise         $exercise = $this->getExercise();         if (false === $this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {             $this->toolBox()->i18nLog()->warning('account-length-error', ['%code%' => $this->codsubcuenta]);             return false;         }

Patch:
patch: @@ -205,8 +205,12 @@ public function test(): bool
     {
         $this->saldo = $this->debe - $this->haber;
 
-        $this->codcuenta = trim($this->codcuenta);
-        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : trim($this->codsubcuenta);
+        // escape html
+        foreach (['codcuenta', 'codsubcuenta', 'descripcion', 'codcuentaesp'] as $field) {
+            $this->{$field} = self::toolBox()::utils()::noHtml($this->{$field});
+        }
+
+        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : $this->codsubcuenta;
         $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
         if (strlen($this->descripcion) < 1 || strlen($this->descripcion) > 255) {
             $this->toolBox()->i18nLog()->warning(
@@ -218,7 +222,7 @@ public function test(): bool
 
         // check exercise
         $exercise = $this->getExercise();
-        if (!$this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
+        if (false === $this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
             $this->toolBox()->i18nLog()->warning('account-length-error', ['%code%' => $this->codsubcuenta]);
             return false;
         }
path: Core/Model/Subcuenta.php