Issue #4249 - Fix CWE-79: Cross-Site Scripting

[omordyk]

Description

Cross Site Scripting (XSS) vulnerability occurs when an application either does not perform or it performs incorrect neutralization (sanitization) of input data that is included in a web application response. As the result, an attacker is able to inject and execute arbitrary HTML and script code in a user's browser within the context of the vulnerable website. These attacks are often used to steal authentication credentials (e.g. session IDs in cookies). Depending on the vulnerability and the web application, it is also possible to completely alter the web page itself or control the victim's browser

A sensitive sink function was discovered in line 1167 of the file agreementbot/api.go. It causes a High severity Cross-Site Scripting vulnerability.

html.EscapeString is a function from Go’s html package that escapes a string to ensure any potentially unsafe characters (like <, >, ", and &) are converted into HTML entities (e.g., < becomes <).

Fixes # (issue)

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

make test

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings
• I have tagged the reviewers in a comment below incase my pull request is ready for a review
• I have signed the commit message to agree to Developer Certificate of Origin (DCO) (to certify that you wrote or otherwise have the right to submit your contribution to the project.) by adding "--signoff" to my git commit command.

[omordyk]

@LiilyZhang @kroczi pls review

[LiilyZhang]

Looks like the e2edev failed on secret testing