Skip to content

[FIX] Backport GHSA patches and fixes from hotfix_v2.4.29 #1087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Che4ter wants to merge 6 commits into
base: develop
Choose a base branch
from
+28 −23
Open

[FIX] Backport GHSA patches and fixes from hotfix_v2.4.29 #1087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7257d4a
[#893][FIX] Fixed duplicated entries
whikernel Aug 31, 2025
323c6d1
[FIX] Sanitation in multiple views
Apr 20, 2026
465c135
[FIX] Sanitize remaining customer-view columns and preserve raw sort/…
Che4ter Jul 8, 2026
04e9b04
[FIX] Sanitize modification-history entries in alert history modal
Che4ter Jul 8, 2026
34fa28b
[FIX] Sanitize alert title in asset linked-alerts popover
Che4ter Jul 8, 2026
224d353
[FIX] Align 'state' column null-guard with sibling owner/asset_type c…
Che4ter Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion ui/src/pages/alerts.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1288,11 +1288,13 @@ async function showAlertHistory(alertId) {
let alertData = alertDataReq.data;
let entryDiv = $('#modal_alert_history_content');

entryDiv.empty();

for (let entry in alertData.modification_history) {
let date = new Date(Math.floor(entry) * 1000);
let dateStr = date.toLocaleString();
let entryStr = alertData.modification_history[entry];
entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + entryStr.user + '</div><div class="col-6">'+ entryStr.action +'</div></div>');
entryDiv.append('<div class="row"><div class="col-3">' + dateStr + '</div><div class="col-3">' + sanitizeHTML(entryStr.user) + '</div><div class="col-6">'+ sanitizeHTML(entryStr.action) +'</div></div>');

}

Expand Down
2 changes: 1 addition & 1 deletion ui/src/pages/case.asset.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,7 +446,7 @@ $(document).ready(function(){
let alerts_content = "";

row.alerts.forEach(alert => {
alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${alert.alert_title.replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
alerts_content += `<i tabindex="0" class="fas fa-bell text-warning mr-2"></i><a href=\"/alerts?alert_ids=${alert.alert_id}&page=1&per_page=1&sort=desc\" target="_blank" rel="noopener">#${alert.alert_id} - ${sanitizeHTML(alert.alert_title).replace(/'/g, "&#39;").replace(/"/g, "&quot;")}</a><br/>`;
} );
alerts_content += `<i tabindex="0" class="fas fa-external-link-square mr-2"></i><a href=\"/alerts?alert_assets=${data}" target="_blank" rel="noopener">More..</a>`;

Expand Down
45 changes: 24 additions & 21 deletions ui/src/pages/view.customers.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,15 @@ function refresh_client_users(customer_id) {
})
}

// Sanitize only for the 'display' render type — DataTables also calls
// render() with 'sort'/'filter'/'type' to build its internal index, and
// those should compare against the raw value rather than the
// HTML-encoded one, or search/sort silently stops matching values that
// contain HTML-significant characters.
function safeTextRender(data, type) {
return type === 'display' ? sanitizeHTML(data) : data;
}

$(document).ready(function() {

let customer_id = $('#customer_id').val();
Expand All @@ -134,16 +143,12 @@ $(document).ready(function() {
},
{
"data": "user_name",
"render": function(data, type, row) {
return data;
}
"render": safeTextRender

},
{
"data": "user_login",
"render": function(data, type, row) {
return data;
}
"render": safeTextRender
},
{
"data": "is_service_account",
Expand All @@ -160,28 +165,24 @@ $(document).ready(function() {
"columns": [
{
"data": "asset_name",
"render": function(data, type, row) {
return data;
}
"render": safeTextRender
},
{
"data": "asset_description",
"render": function(data, type, row) {
return data;
}

"render": safeTextRender
},
{
"data": "asset_type",
"render": function(data, type, row) {
return data.asset_name;
if (!data) {
return '';
}
return type === 'display' ? sanitizeHTML(data.asset_name) : data.asset_name;
}
},
{
"data": "asset_ip",
"render": function(data, type, row) {
return data;
}
"render": safeTextRender
},
{
"data": "case_id",
Expand Down Expand Up @@ -253,17 +254,19 @@ $(document).ready(function() {
{
"data": "state",
"render": function(data, type, row) {
if (data !== null) {
return data.state_name;
} else {
if (!data) {
return 'Unknown';
}
return type === 'display' ? sanitizeHTML(data.state_name) : data.state_name;
}
},
{
"data": "owner",
"render": function(data, type, row) {
return data.user_name;
if (!data) {
return '';
}
return type === 'display' ? sanitizeHTML(data.user_name) : data.user_name;
}
}
],
Expand Down