GHSA-pf56-h9qf-rxq4 Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

• npm @saltcorn/server: < 1.0.0-beta.16 → fixed in 1.0.0-beta.16

Summary Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability. Details • file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445 ```js router.get( "/:id", isAdmin, error_catcher(async (req, res) => { const { id } = req.params; const ev = await EventLog.findOneWithUser(id); send_events_page({ [...] contents: { type: "card", contents: [...] ) + div( { class: "eventpayload" }, ev.payload ? pre(JSON.stringify(ev.payload, null, 2)) : "" //>` • leave default values for `Attributes` and click `Next >>` - it should redirect to `http://localhost:3000/table/` • under `Edit table properties`, set `Minimum role to read` and `Minimum role to write` to `staff` 2. create an edit view so that staff users can insert more data • visit `http://localhost:3000/viewedit` anc click `Create View` • set the following values: • `View name`: `my_xss_view` • `View pattern`: `Edit` • `Table`: `my_table_xss` • `Minimum role`: `staff` • click `Configure >>` • on page `http://localhost:3000/viewedit/config/my_xss_view` click `Next >>` and then `Finish >>` • you should see a message `View my_xss_view saved` 3. edit the site structure to add the View just created so that `staff` users can access it • visit `http://localhost:3000/menu` • set the following values: • `Type`: `View` • `View`: `my_xss_view [Edit]` • `Text label`: `view` • `Minimum role`: `staff` • click `Add` 4. create an event that will log when data is inserted in the `my_table_xss` table create at step 1 • visit `http://localhost:3000/eventlog/settings` • under `Which events should be logged?` select: • `[X] Insert` • `[X] Insert my_table_xss` Login with a user with staff role (you can do the same steps also with an admin user) • visit `http://localhost:3000/view/my_xss_view` • in the `payload` field insert ``"`` and click `Save` With an admin user inspect the log entry generated by the above action: • visit `http://localhost:3000/eventlog` • click on the event log generated (`http://localhost:3000/eventlog/`) • an alert will appear Impact Stored Cross-Site Scripting (XSS) Recommended Mitigation Sanitize the user input before building HTML elements