CVE-2022-1926 (published 2022-05-31T09:15Z)

Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-28 03:01:44-04:00
msg: fix(messages): xss security
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -19,6 +19,7 @@ const piexifjs = require('piexifjs')
 
 const MAX_FIELD_TEXT_LENGTH = 255
 const MAX_SHORT_FIELD_TEXT_LENGTH = 25
+const MAX_EXTREME_TEXT_LENGTH = 2000
 
 module.exports.applyMaxTextLength = function (text) {
   return text.toString().substring(0, MAX_FIELD_TEXT_LENGTH)
@@ -28,6 +29,10 @@ module.exports.applyMaxShortTextLength = function (text) {
   return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
 }
 
+module.exports.applyExtremeTextLength = function (text) {
+  return text.toString().substring(0, MAX_EXTREME_TEXT_LENGTH)
+}
+
 module.exports.sanitizeFieldPlainText = function (text) {
   return xss(text, {
     whileList: {},

programming_language: JavaScript
filename: message.js
change_type: ModificationType.MODIFY
diff: @@ -12,12 +12,13 @@
  *  Copyright (c) 2014-2019. All rights reserved.
  */
 
-var mongoose = require('mongoose')
-var _ = require('lodash')
+const mongoose = require('mongoose')
+const _ = require('lodash')
+const utils = require('../../helpers/utils')
 
-var COLLECTION = 'messages'
+const COLLECTION = 'messages'
 
-var messageSchema = mongoose.Schema(
+const messageSchema = mongoose.Schema(
   {
     conversation: {
       type: mongoose.Schema.Types.ObjectId,
@@ -35,6 +36,12 @@ var messageSchema = mongoose.Schema(
   { timestamps: true }
 )
 
+messageSchema.pre('save', function (next) {
+  this.body = utils.sanitizeFieldPlainText(utils.applyExtremeTextLength(this.body))
+
+  next()
+})
+
 messageSchema.statics.getFullConversation = function (convoId, callback) {
   return this.model(COLLECTION)
     .find({ conversation: convoId })
@@ -65,14 +72,14 @@ messageSchema.statics.getConversationWithObject = function (object, callback) {
     return callback('Invalid Object (Must by of type Object) - MessageSchema.GetUserWithObject()', null)
   }
 
-  var self = this
-  var deletedAt = null
+  const self = this
+  let deletedAt = null
 
-  var limit = object.limit === null ? 25 : object.limit
-  var page = object.page === null ? 0 : object.page
+  const limit = object.limit === null ? 25 : object.limit
+  const page = object.page === null ? 0 : object.page
 
   if (object.requestingUser) {
-    var userMetaIdx = _.findIndex(object.userMeta, function (item) {
+    const userMetaIdx = _.findIndex(object.userMeta, function (item) {
       return item.userId.toString() === object.requestingUser._id.toString()
     })
     if (userMetaIdx !== -1 && object.userMeta[userMetaIdx].deletedAt) {
@@ -80,7 +87,7 @@ messageSchema.statics.getConversationWithObject = function (object, callback) {
     }
   }
 
-  var q = self
+  const q = self
     .model(COLLECTION)
     .find({})
     .sort('-createdAt')

programming_language: JavaScript