From dd579937e36ec494372d8d99b49d0943ea2b721d Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Thu, 23 Feb 2017 18:51:11 -0500
Subject: Add helper method to use implode() with HTML escaping

---
 ChangeLog                                     |  1 +
 app/Helper/TextHelper.php                     | 13 +++++++++++++
 app/Template/project_overview/information.php |  4 ++--
 tests/units/Helper/TextHelperTest.php         |  7 +++++++
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 183913b9..ff19067c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -38,6 +38,7 @@ Bug fixes:
 
 * Upload files button stay disabled when there are other submit buttons on the same page
 * Hiding subtasks from hidden tasks in dashboard
+* Avoid potential XSS in project overview when listing users (was avoided by default CSP rules)
 
 Version 1.0.39 (Feb 12, 2017)
 -----------------------------
diff --git a/app/Helper/TextHelper.php b/app/Helper/TextHelper.php
index 66583cd1..89c1a8f3 100644
--- a/app/Helper/TextHelper.php
+++ b/app/Helper/TextHelper.php
@@ -24,6 +24,19 @@ class TextHelper extends Base
         return htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false);
     }
 
+    /**
+     * Join with HTML escaping
+     *
+     * @param  $glue
+     * @param  array $list
+     * @return string
+     */
+    public function implode($glue, array $list)
+    {
+        array_walk($list, function (&$value) { $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false); });
+        return implode($glue, $list);
+    }
+
     /**
      * Markdown transformation
      *
diff --git a/app/Template/project_overview/information.php b/app/Template/project_overview/information.php
index 0fe53e08..e8c20903 100644
--- a/app/Template/project_overview/information.php
+++ b/app/Template/project_overview/information.php
@@ -13,8 +13,8 @@
                     <?php foreach ($roles as $role => $role_name): ?>
                         <?php if (isset($users[$role])): ?>
                             <li>
-                                <?= $role_name ?>:
-                                <strong><?= implode(', ', $users[$role]) ?></strong>
+                                <?= $this->text->e($role_name) ?>:
+                                <strong><?= $this->text->implode(', ', $users[$role]) ?></strong>
                             </li>
                         <?php endif ?>
                     <?php endforeach ?>
diff --git a/tests/units/Helper/TextHelperTest.php b/tests/units/Helper/TextHelperTest.php
index 35ed5a1e..abe921fe 100644
--- a/tests/units/Helper/TextHelperTest.php
+++ b/tests/units/Helper/TextHelperTest.php
@@ -9,6 +9,13 @@ use Kanboard\Model\UserModel;
 
 class TextHelperTest extends Base
 {
+    public function testImplode()
+    {
+        $textHelper = new TextHelper($this->container);
+        $html = '&lt;img src=x onerror=alert(0)&gt;';
+        $this->assertEquals($html, $textHelper->implode(', ', array('<img src=x onerror=alert(0)>')));
+    }
+
     public function testMarkdownTaskLink()
     {
         $textHelper = new TextHelper($this->container);
-- 
cgit v1.2.3