From 84622bf27bf6dff7740b8b845e4459d1fa018678 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Wed, 11 Jul 2018 13:10:57 +0200
Subject: [PATCH] Fix some XSS vulnerabilities

Only a real issue with <= IE9 as other browsers properly escape
urls prior transmission.

Signed-off-by: Eric Lippmann <eric.lippmann@icinga.com>
---
 application/layouts/scripts/body.phtml          | 2 +-
 application/views/scripts/mixedPagination.phtml | 6 +++---
 library/Icinga/Web/Widget/Tab.php               | 2 +-
 library/Icinga/Web/Widget/Tabs.php              | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/application/layouts/scripts/body.phtml b/application/layouts/scripts/body.phtml
index 2a9ec2fa7..cb1b55743 100644
--- a/application/layouts/scripts/body.phtml
+++ b/application/layouts/scripts/body.phtml
@@ -46,7 +46,7 @@ if ($this->layout()->inlineLayout) {
 </div>
 <?php endif ?>
 <div id="main" role="main">
-  <div id="col1" class="container<?= $moduleClass ?>"<?php if ($moduleName): ?> data-icinga-module="<?= $moduleName ?>" <?php endif ?> data-icinga-url="<?= Url::fromRequest()->without('renderLayout'); ?>"<?= $refresh; ?> style="display: block">
+  <div id="col1" class="container<?= $moduleClass ?>"<?php if ($moduleName): ?> data-icinga-module="<?= $moduleName ?>" <?php endif ?> data-icinga-url="<?= $this->escape(Url::fromRequest()->without('renderLayout')->getAbsoluteUrl()); ?>"<?= $refresh; ?> style="display: block">
     <?= $this->render($inlineLayoutScript) ?>
   </div>
   <div id="col2" class="container">
diff --git a/application/views/scripts/mixedPagination.phtml b/application/views/scripts/mixedPagination.phtml
index 0c4ad94c4..e92a9c92c 100644
--- a/application/views/scripts/mixedPagination.phtml
+++ b/application/views/scripts/mixedPagination.phtml
@@ -10,7 +10,7 @@
             $this->totalItemCount
         ) ?>
         <li class="nav-item">
-            <a  href="<?= $this->url()->overwriteParams(array('page' => $this->previous)) ?>"
+            <a  href="<?= $this->escape($this->url()->overwriteParams(array('page' => $this->previous))->getAbsoluteUrl()) ?>"
                 title="<?= $label ?>"
                 aria-label="<?= $label ?>"
                 class="previous-page">
@@ -44,7 +44,7 @@
             );
             ?>
             <li<?= $page === $this->current ? ' class="active nav-item"' : ' class="nav-item"' ?>>
-                <a  href="<?= $this->url()->overwriteParams(array('page' => $page)) ?>"
+                <a  href="<?= $this->escape($this->url()->overwriteParams(array('page' => $page))->getAbsoluteUrl()) ?>"
                     title="<?= $label ?>"
                     aria-label="<?= $label ?>">
                     <?= $page ?>
@@ -60,7 +60,7 @@
             $this->totalItemCount
         ) ?>
         <li class="nav-item">
-            <a  href="<?= $this->url()->overwriteParams(array('page' => $this->next)) ?>"
+            <a  href="<?= $this->escape($this->url()->overwriteParams(array('page' => $this->next))->getAbsoluteUrl()) ?>"
                 title="<?= $label ?>"
                 aria-label="<?= $label ?>"
                 class="next-page">
diff --git a/library/Icinga/Web/Widget/Tab.php b/library/Icinga/Web/Widget/Tab.php
index 9c9a1630a..d2d3f327b 100644
--- a/library/Icinga/Web/Widget/Tab.php
+++ b/library/Icinga/Web/Widget/Tab.php
@@ -309,7 +309,7 @@ class Tab extends AbstractWidget
 
             $tab = sprintf(
                 '<a href="%s"%s>%s</a>',
-                $this->url,
+                $this->view()->escape($this->url->getAbsoluteUrl()),
                 $params,
                 $caption
             );
diff --git a/library/Icinga/Web/Widget/Tabs.php b/library/Icinga/Web/Widget/Tabs.php
index ffe7934a2..f490302a8 100644
--- a/library/Icinga/Web/Widget/Tabs.php
+++ b/library/Icinga/Web/Widget/Tabs.php
@@ -342,7 +342,7 @@ EOT;
                 '{LABEL}'
             ),
             array(
-                $url,
+                $this->view()->escape($url->getAbsoluteUrl()),
                 $title,
                 $label
             ),