Merge pull request #13 from baseVISION/fix/customer-view-alert-sanitization

Sanitize remaining XSS gaps in customer view and alert modal/popover

Author: Che4ter

ui/src/pages/alerts.js

@@ -1294,7 +1294,7 @@ async function showAlertHistory(alertId) {
         let date = new Date(Math.floor(entry) * 1000);
         let dateStr = date.toLocaleString();
         let entryStr = alertData.modification_history[entry];
-        entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + entryStr.user + '</div><div class="col-6">'+ entryStr.action +'</div></div>');
+        entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + sanitizeHTML(entryStr.user) + '</div><div class="col-6">'+ sanitizeHTML(entryStr.action) +'</div></div>');
 
     }
 

ui/src/pages/case.asset.js

@@ -401,7 +401,7 @@ $(document).ready(function(){
                         let alerts_content = "";
 
                         row.alerts.forEach(alert => {
-                            alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${alert.alert_title.replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
+                            alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${sanitizeHTML(alert.alert_title).replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
                         }  );
                         alerts_content += `<i tabindex="0" class="fas fa-external-link-square mr-2"></i><a href=\"/alerts?alert_assets=${data}" target="_blank" rel="noopener">More..</a>`;
 

ui/src/pages/view.customers.js

@@ -113,6 +113,15 @@ function refresh_client_users(customer_id) {
         })
 }
 
+// Sanitize only for the 'display' render type — DataTables also calls
+// render() with 'sort'/'filter'/'type' to build its internal index, and
+// those should compare against the raw value rather than the
+// HTML-encoded one, or search/sort silently stops matching values that
+// contain HTML-significant characters.
+function safeTextRender(data, type) {
+    return type === 'display' ? sanitizeHTML(data) : data;
+}
+
 $(document).ready(function() {
 
     let customer_id = $('#customer_id').val();
@@ -134,16 +143,12 @@ $(document).ready(function() {
             },
             {
                 "data": "user_name",
-                "render": function(data, type, row) {
-                    return sanitizeHTML(data);
-                }
+                "render": safeTextRender
 
             },
             {
                 "data": "user_login",
-                "render": function(data, type, row) {
-                    return sanitizeHTML(data);
-                }
+                "render": safeTextRender
             },
             {
                 "data": "is_service_account",
@@ -160,28 +165,24 @@ $(document).ready(function() {
         "columns": [
             {
                 "data": "asset_name",
-                "render": function(data, type, row) {
-                    return sanitizeHTML(data);
-                }
+                "render": safeTextRender
             },
             {
                 "data": "asset_description",
-                "render": function(data, type, row) {
-                    return sanitizeHTML(data);
-                }
-
+                "render": safeTextRender
             },
             {
                 "data": "asset_type",
                 "render": function(data, type, row) {
-                    return sanitizeHTML(data.asset_name);
+                    if (!data) {
+                        return '';
+                    }
+                    return type === 'display' ? sanitizeHTML(data.asset_name) : data.asset_name;
                 }
             },
             {
                 "data": "asset_ip",
-                "render": function(data, type, row) {
-                    return sanitizeHTML(data);
-                }
+                "render": safeTextRender
             },
             {
                 "data": "case_id",
@@ -241,7 +242,7 @@ $(document).ready(function() {
                         a_anchor.text(data);
                         return a_anchor.prop('outerHTML');
                     }
-                    return sanitizeHTML(data);
+                    return data;
                 }
             },
             {
@@ -253,17 +254,19 @@ $(document).ready(function() {
             {
                 "data": "state",
                 "render": function(data, type, row) {
-                    if (data !== null) {
-                        return data.state_name;
-                    } else {
+                    if (!data) {
                         return 'Unknown';
                     }
+                    return type === 'display' ? sanitizeHTML(data.state_name) : data.state_name;
                 }
             },
             {
                 "data": "owner",
                 "render": function(data, type, row) {
-                    return data.user_name;
+                    if (!data) {
+                        return '';
+                    }
+                    return type === 'display' ? sanitizeHTML(data.user_name) : data.user_name;
                 }
             }
         ],