[Security] Cookie-based Cross-site scripting

[ghost]

Subject of the issue

Cross-site scripting (XSS) vulnerability in RaspAP-webgui v1.3.1 allow remote attackers (users) to inject arbitrary web script or HTML via the theme cookie.

Steps to reproduce

1. Login
2. Execute document.cookie = 'theme="><svg/onload=alert()>;path=/'; in your Javascript console

Now, each time you'll access to a RaspAP-webgui page, alert() will be triggered.

This vulnerability can be used, if an attacker finds another vulnerability to set arbitrary cookies to the user.

Expected behaviour

theme cookie needs to be filtered, before being returned in the page.

[billz]

Fixed with PR.