Patch XSS vulnerability

[zinduolis]

Pull Request

Thanks for submitting a PR! Please fill in this template where appropriate:

Category

Bug

Feature/Issue Description

Q: Please give a brief summary of your feature/fix
A: Patches a Stored XSS vulnerability in the Admin UI's "Hooked Browsers" tooltip and sanitizes all incoming browser details before persistence.

Q: Give a technical rundown of what you have changed (if applicable)
A:

1. Core Filters Fortified: Fixed a logic bug in BeEF::Filters.has_valid_browser_details_chars? (core/filters/base.rb) where an inverted regex allowed invalid characters to pass.
2. String Validation Upgraded: Updated the strict string filters in core/filters/browser.rb (is_valid_osname?, is_valid_browsername?, etc.) to explicitly reject strings containing HTML/XSS payloads by calling the corrected has_valid_browser_details_chars? function instead of just checking for non-printable characters.
3. Database Injection Prevented: Refactored core/main/handlers/browserdetails.rb to assign safe 'Unknown' fallback values if BeEF::Filters validation fails, preventing unvalidated local variables from flowing into SQLite database instances and Terminal Logger output.
4. Missing Validation Added: Added missing sanitization checks for previously unprotected properties in browserdetails.rb (including proxy headers VIA / X-Forwarded-For) before persistence.
5. UI Protection: Updated zombiesTreeList.js to use Ext.util.Format.htmlEncode() for tooltip fields as a defense-in-depth measure.

Test Cases

Q: Describe your test cases, what you have covered and if there are any use cases that still need addressing.
A: Reproduced the XSS using a custom Python PoC script. Verified the payloads are discarded at the controller level (browserdetails.rb) and no longer persist into the SQLite database.

Wiki Page

If you are adding a new feature that is not easily understood without context, please draft a section to be added to the Wiki below.
N/A

[bcoles]

If this is a valid issue it should also be patched in core/main/handlers/browserdetails.rb. Browser details should not be used if they are invalid.

[zinduolis]

If this is a valid issue it should also be patched in core/main/handlers/browserdetails.rb. Browser details should not be used if they are invalid.

Cheers for the feedback, @bcoles ! I've updated the code to sort out that stored XSS issue you flagged.

I've also given it a good test locally by trying to inject scripts into the previously unsanitised fields, and it all looks fully sorted now. Assuming the tests pass, are we good to merge this in?