Description

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Proof of Concept

Code 1:

$recordLang = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
$tags = Filter::filterInput(INPUT_POST, 'tags', FILTER_UNSAFE_RAW);
$active = Filter::filterInput(INPUT_POST, 'active', FILTER_UNSAFE_RAW);
$sticky = Filter::filterInput(INPUT_POST, 'sticky', FILTER_UNSAFE_RAW);
$content = Filter::filterInput(INPUT_POST, 'answer', FILTER_SANITIZE_SPECIAL_CHARS);
$keywords = Filter::filterInput(INPUT_POST, 'keywords', FILTER_UNSAFE_RAW);
$author = Filter::filterInput(INPUT_POST, 'author', FILTER_UNSAFE_RAW);
$email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$comment = Filter::filterInput(INPUT_POST, 'comment', FILTER_UNSAFE_RAW);
$recordId = Filter::filterInput(INPUT_POST, 'id', FILTER_VALIDATE_INT);
$solutionId = Filter::filterInput(INPUT_POST, 'solution_id', FILTER_VALIDATE_INT);
$revisionId = Filter::filterInput(INPUT_POST, 'revision_id', FILTER_VALIDATE_INT);
$changed = Filter::filterInput(INPUT_POST, 'changed', FILTER_UNSAFE_RAW);
$date = Filter::filterInput(INPUT_POST, 'date', FILTER_UNSAFE_RAW);
$notes = Filter::filterInput(INPUT_POST, 'notes', FILTER_UNSAFE_RAW);

Code 2:

$faqData['active'] = Filter::filterInput(INPUT_POST, 'active', FILTER_UNSAFE_RAW);
$faqData['keywords'] = Filter::filterInput(INPUT_POST, 'keywords', FILTER_UNSAFE_RAW);
$faqData['title'] = Filter::filterInput(INPUT_POST, 'thema', FILTER_UNSAFE_RAW);
$faqData['content'] = Filter::filterInput(INPUT_POST, 'content', FILTER_SANITIZE_SPECIAL_CHARS);
$faqData['author'] = Filter::filterInput(INPUT_POST, 'author', FILTER_UNSAFE_RAW);
$faqData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$faqData['comment'] = Filter::filterInput(INPUT_POST, 'comment', FILTER_UNSAFE_RAW);
$faqData['solution_id'] = Filter::filterInput(INPUT_POST, 'solution_id', FILTER_VALIDATE_INT);
$faqData['revision_id'] = Filter::filterInput(INPUT_POST, 'revision_id', FILTER_VALIDATE_INT, 0);
$faqData['sticky'] = Filter::filterInput(INPUT_POST, 'sticky', FILTER_VALIDATE_INT);
$faqData['tags'] = Filter::filterInput(INPUT_POST, 'tags', FILTER_UNSAFE_RAW);
$faqData['changed'] = Filter::filterInput(INPUT_POST, 'changed', FILTER_UNSAFE_RAW);
$faqData['dateStart'] = Filter::filterInput(INPUT_POST, 'dateStart', FILTER_UNSAFE_RAW);
$faqData['dateEnd'] = Filter::filterInput(INPUT_POST, 'dateEnd', FILTER_UNSAFE_RAW);
$faqData['content'] = html_entity_decode((string) $faqData['content']);
} elseif ('editentry' === $action) {
$id = Filter::filterInput(INPUT_GET, 'id', FILTER_VALIDATE_INT);
$lang = Filter::filterInput(INPUT_GET, 'lang', FILTER_UNSAFE_RAW);
$translateTo = Filter::filterInput(INPUT_GET, 'translateTo', FILTER_UNSAFE_RAW);
$categoryId = Filter::filterInput(INPUT_GET, 'cat', FILTER_VALIDATE_INT);

Code 3:

// FAQ data
$dateStart = Filter::filterInput(INPUT_POST, 'dateStart', FILTER_UNSAFE_RAW);
$dateEnd = Filter::filterInput(INPUT_POST, 'dateEnd', FILTER_UNSAFE_RAW);
$question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
$categories = Filter::filterInputArray(
INPUT_POST,
[
'rubrik' => [
'filter' => FILTER_VALIDATE_INT,
'flags' => FILTER_REQUIRE_ARRAY,
],
]
);
$recordLang = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
$tags = Filter::filterInput(INPUT_POST, 'tags', FILTER_UNSAFE_RAW);
$active = 'yes' == Filter::filterInput(
INPUT_POST,
'active',
FILTER_UNSAFE_RAW
) && $user->perm->hasPermission($user->getUserId(), 'approverec') ? 'yes' : 'no';
$sticky = Filter::filterInput(INPUT_POST, 'sticky', FILTER_UNSAFE_RAW);
$content = Filter::filterInput(INPUT_POST, 'answer', FILTER_SANITIZE_SPECIAL_CHARS);
$keywords = Filter::filterInput(INPUT_POST, 'keywords', FILTER_UNSAFE_RAW);
$author = Filter::filterInput(INPUT_POST, 'author', FILTER_UNSAFE_RAW);
$email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
$comment = Filter::filterInput(INPUT_POST, 'comment', FILTER_UNSAFE_RAW);
$recordId = Filter::filterInput(INPUT_POST, 'record_id', FILTER_VALIDATE_INT);
$solutionId = Filter::filterInput(INPUT_POST, 'solution_id', FILTER_VALIDATE_INT);
$revision = Filter::filterInput(INPUT_POST, 'revision', FILTER_UNSAFE_RAW);
$revisionId = Filter::filterInput(INPUT_POST, 'revision_id', FILTER_VALIDATE_INT);
$changed = Filter::filterInput(INPUT_POST, 'changed', FILTER_UNSAFE_RAW);
$date = Filter::filterInput(INPUT_POST, 'date', FILTER_UNSAFE_RAW);
$notes = Filter::filterInput(INPUT_POST, 'notes', FILTER_UNSAFE_RAW);