User inputs need to be sanitized

[khalidadil]

Summary

The “Condition Widget” object is vulnerable against stored DOM-based XSS (in v1.1.1 to v1.7.5) that allows the injection of malicious JavaScript into the ‘URL’ field.

Files impacted:
https://github.com/nasa/openmct/blob/master/src/plugins/conditionWidget/plugin.js#L50
https://github.com/nasa/openmct/blob/master/src/plugins/conditionWidget/components/ConditionWidget.vue#L26

---

The “Summary Widget” object is vulnerable against stored DOM-based XSS (in v0.13.1 to v1.7.5) that allows the injection of malicious JavaScript into the ‘URL’ field.

Files impacted:
https://github.com/nasa/openmct/blob/master/src/plugins/summaryWidget/src/SummaryWidget.js#L116

---

The “Web Page” object is vulnerable against stored DOM-based XSS (in v1.1.1 to v1.7.5) that allows the injection of malicious JavaScript into the ‘URL’ field.

Files impacted:
https://github.com/nasa/openmct/blob/master/src/plugins/webPage/plugin.js#L37
https://github.com/nasa/openmct/blob/master/src/plugins/webPage/components/WebPage.vue#L3

Impact Check List

• Data loss or misrepresented data?
• Regression? Did this used to work or has it always been broken?
• Is there a workaround available?
• Does this impact a critical component?
• Is this just a visual bug?

Steps to Reproduce

Condition Widget Object Vulnerability

• Press the upper left “CREATE” button in order to use the “Condition Widget” object. Once added, enter javascript:alert(“XSS”) in the URL field and press “OK”.
• Navigate to the new Condition object.
• An alert will be presented.

Summary Widget Object Vulnerability

• Press the upper left “CREATE” button in order to use the “Summary Widget” object. Once added, enter javascript:alert(“XSS”) in the URL field and press “OK”.
• Navigate to the new Summary object and press the green "Unnamed Rule" button.
• An alert message will be presented.

Web Page Object Vulnerability

• Press the upper left “CREATE” button in order to use the “Web Page” object. Once added, enter javascript:alert(“XSS”) in the URL field and press “OK”.
• Navigate to the new Web Page object.
• An alert message will be presented.

[jvigliotta]

Verified Fixed - Testathon 10/8