CVE-2023-6599 (published 2023-12-08T00:15Z)

Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2023-06-08 17:32:44+03:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: PluploadController.php
change_type: ModificationType.MODIFY
diff: @@ -358,9 +358,9 @@ class PluploadController extends Controller
         $fileName = preg_replace('/\s+\d+%|\)/', '', $fileName);
         $fileName = preg_replace("/[\/\&%#\$]/", "_", $fileName);
         $fileName = preg_replace("/[\"\']/", " ", $fileName);
-        $fileName = str_replace(array('(', ')', "'", "!", "`", "*", "#"), '_', $fileName);
-        $fileName = str_replace(' ', '_', $fileName);
-        $fileName = str_replace('..', '.', $fileName);
+        $fileName = str_replace(array('(', ')', "'", "!", "`", "*", "#", "<", ">"), '-', $fileName);
+        $fileName = str_replace(' ', '-', $fileName);
+        $fileName = str_replace('..', '-', $fileName);
         $fileName = strtolower($fileName);
         $fileName = mw()->url_manager->clean_url_wrappers($fileName);
         $fileName = substr($fileName, 0, -(strlen($fileNameExtension)));

programming_language: PHP
filename: MediaManager.php
change_type: ModificationType.MODIFY
diff: @@ -380,7 +380,7 @@ class MediaManager
     public function save($data)
     {
         $data = app()->html_clean->cleanArray($data);
-
+        $data = xss_clean($data);
         $s = array();
 
         if (isset($data['content-id'])) {
@@ -513,6 +513,9 @@ class MediaManager
 
             $s['filename'] = $data['src'];
         }
+        if (isset($s['filename']) && !is_string($s['filename'])) {
+           return false;
+        }
 
         if (!isset($data['position']) and !isset($s['id'])) {
             $s['position'] = 9999999;
@@ -525,6 +528,7 @@ class MediaManager
 
         if ((!isset($s['id']) or (isset($s['id']) and $s['id'] == 0))
             and isset($s['filename'])
+            and is_string($s['filename'])
             and isset($s['rel_id'])
             and isset($s['rel_type'])
         ) {
@@ -540,7 +544,7 @@ class MediaManager
             }
         }
 
-        if (!isset($s['id']) and isset($s['filename']) and !isset($data['media_type'])) {
+        if (!isset($s['id']) and isset($s['filename']) and is_string($s['filename']) and !isset($data['media_type'])) {
             $ext = get_file_extension($s['filename']);
             $data['media_type'] = $this->_guess_media_type_from_file_ext($ext);
         }
@@ -559,11 +563,6 @@ class MediaManager
             $s['image_options'] = @json_encode($data['image_options']);
         }
 
-        if (isset($s['filename']) && is_array($s['filename'])) {
-            if (isset($s['filename']['error'])) {
-                return false;
-            }
-        }
 
         if (isset($s['rel_type']) and isset($s['rel_id'])) {
             $s['rel_id'] = trim($s['rel_id']);

programming_language: PHP
filename: MediaTrait.php
change_type: ModificationType.MODIFY
diff: @@ -82,7 +82,7 @@ trait MediaTrait
                                 'rel_id' => $model->id,
                                 'title' => 'Picture',
                                 'media_type' => 'picture',
-                                'src' => $url,
+                                'filename' => $url,
                             ));
                         }
                     }

programming_language: PHP
filename: 2020_07_02_000000_create_media_table.php
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,7 @@ class CreateMediaTable extends Migration
                 $table->id();
                 $table->text('title')->nullable();
                 $table->text('description')->nullable();
-                $table->text('embed_code')->nullable();
+                //$table->text('embed_code')->nullable();
                 $table->text('filename')->nullable();
                 $table->text('media_type')->nullable()->index();
 

programming_language: PHP
filename: LegacyMediaTest.php
change_type: ModificationType.RENAME
diff: @@ -4,7 +4,7 @@ namespace MicroweberPackages\Media\tests;
 
 use MicroweberPackages\Core\tests\TestCase;
 
-class MediaTest extends TestCase
+class LegacyMediaTest extends TestCase
 {
     public function testSaveMedia()
     {
@@ -13,7 +13,7 @@ class MediaTest extends TestCase
             'rel_id' => 3,
             'title' => 'My new pic',
             'media_type' => 'picture',
-            'src' => 'http://lorempixel.com/400/200/',
+            'filename' => 'http://lorempixel.com/400/200/',
         );
         $saved_pic_id = save_media($picture);
 
@@ -35,7 +35,7 @@ class MediaTest extends TestCase
             'rel_id' => 3,
             'title' => 'My new pic to del',
             'media_type' => 'picture',
-            'src' => 'http://lorempixel.com/400/200/',
+            'filename' => 'http://lorempixel.com/400/200/',
         );
         $saved_pic_id = save_media($picture);
         $picture_data = get_media_by_id($saved_pic_id);
@@ -48,5 +48,42 @@ class MediaTest extends TestCase
         $this->assertEquals(is_array($picture_data), true);
         $this->assertEquals($title, 'My new pic to del');
         $this->assertEquals(!($delete), false);
+    }
+
+    public function testSaveMediaArrayInFilename()
+    {
+        $picture = array(
+            'rel_type' => 'content',
+            'rel_id' => 3,
+            'title' => 'My new pic',
+            'media_type' => 'picture',
+            'filename' => ['http://lorempixel.com/400/200/', 'http://lorempixel.com/400/200/'],
+        );
+        $saved_pic_id = save_media($picture);
+
+        $this->assertFalse($saved_pic_id);
+    }
+    public function testSaveMediaXssFilename()
+    {
+        $xss = '<style>@keyframes x{}</style><xss style="animation-name:x" onanimationend="alert(document.cookie)"></xss>';
+
+        $picture = array(
+            'rel_type' => 'content',
+            'rel_id' => 3,
+            'title' => 'My new pic to xss'.$xss,
+            'description' => 'My new pic description xss'.$xss,
+            'media_type' => 'picture',
+            'filename' => 'http://lorempixel.com/400/200/'.$xss,
+        );
+        $saved_pic_id = save_media($picture);
+        $picture_data = get_media_by_id($saved_pic_id);
+
+        $this->assertNotEquals($picture_data['title'], $picture['title']);
+        $this->assertNotEquals($picture_data['description'], $picture['description']);
+        $this->assertNotEquals($picture_data['filename'], $picture['filename']);
+
+
+
+
     }
 }

programming_language: PHP