Vulnerability: Cross-site Scripting in snipe/snipe-it snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability ID: GHSA-c65v-p733-9796
CWE: CWE-79
Severity score: 8
Project: https://github.com/snipe/snipe-it
Published: 2021-11-23
File: app/Http/Transformers/AssetsTransformer.php
Commit message: Merge pull request #10315 from snipe/fixes/escape_custom_fields_in_api_response

Escape custom field values in API response
Commit author: snipe

Vulnerable version (before fix):
 public function transformAsset(Asset $asset)                     $value = (Gate::allows('superadmin')) ? $decrypted : strtoupper(trans('admin/custom_fields/general.encrypted'));                      $fields_array[$field->name] = [                             'field' => $field->convertUnicodeDbSlug(),                             'value' => $value,                             'field_format' => $field->format,                         ];                  } else {                     $fields_array[$field->name] = [                         'field' => $field->convertUnicodeDbSlug(),                         'value' => $asset->{$field->convertUnicodeDbSlug()},                         'field_format' => $field->format,                     ];  public function transformAsset(Asset $asset)                                                      'id' => $component->id,                             'pivot_id' => $component->pivot->id,                             'name' => $component->name,                             'qty' => $component->pivot->assigned_qty,                             'price_cost' => $component->purchase_cost,                             'purchase_total' => $component->purchase_cost * $component->pivot->assigned_qty,

Fixed version (after fix):
 public function transformAsset(Asset $asset)                     $value = (Gate::allows('superadmin')) ? $decrypted : strtoupper(trans('admin/custom_fields/general.encrypted'));                      $fields_array[$field->name] = [                             'field' => e($field->convertUnicodeDbSlug()),                             'value' => e($value),                             'field_format' => $field->format,                         ];                  } else {                     $fields_array[$field->name] = [                         'field' => e($field->convertUnicodeDbSlug()),                         'value' => e($asset->{$field->convertUnicodeDbSlug()}),                         'field_format' => $field->format,                     ];  public function transformAsset(Asset $asset)                                                      'id' => $component->id,                             'pivot_id' => $component->pivot->id,                             'name' => e($component->name),                             'qty' => $component->pivot->assigned_qty,                             'price_cost' => $component->purchase_cost,                             'purchase_total' => $component->purchase_cost * $component->pivot->assigned_qty,

Patch:
patch: @@ -93,15 +93,15 @@ public function transformAsset(Asset $asset)
                     $value = (Gate::allows('superadmin')) ? $decrypted : strtoupper(trans('admin/custom_fields/general.encrypted'));
 
                     $fields_array[$field->name] = [
-                            'field' => $field->convertUnicodeDbSlug(),
-                            'value' => $value,
+                            'field' => e($field->convertUnicodeDbSlug()),
+                            'value' => e($value),
                             'field_format' => $field->format,
                         ];
 
                 } else {
                     $fields_array[$field->name] = [
-                        'field' => $field->convertUnicodeDbSlug(),
-                        'value' => $asset->{$field->convertUnicodeDbSlug()},
+                        'field' => e($field->convertUnicodeDbSlug()),
+                        'value' => e($asset->{$field->convertUnicodeDbSlug()}),
                         'field_format' => $field->format,
                     ];
 
@@ -134,7 +134,7 @@ public function transformAsset(Asset $asset)
                         
                             'id' => $component->id,
                             'pivot_id' => $component->pivot->id,
-                            'name' => $component->name,
+                            'name' => e($component->name),
                             'qty' => $component->pivot->assigned_qty,
                             'price_cost' => $component->purchase_cost,
                             'purchase_total' => $component->purchase_cost * $component->pivot->assigned_qty,
path: app/Http/Transformers/AssetsTransformer.php