Fix several Cross-Site Scripting vulnerabilities

[tch1bo]

Hello,

I noticed three potential Cross-Site Scripting (XSS) vulnerabilities in app/views/challenge.py and app/views/user.py.

When creating a challenge, the name of challenge is returned to the user without any sanitization. This opens a possibility for attackers to make users execute arbitrary code. For example, imagine an attacker can trick a user into accessing the url https://svia.nl/challenge/api/create_challenge?...&name=<script>some_evil_code</script>. In this case some_evil_code will be executed in victim's browser, which has a huge security impact (remote code execution, cookies theft, malicious redirects, etc.)

Same story with https://svia.nl/users/export - if an attacker manages to create an account with e.g. description field set to <script>some_more_evil_code</script>, then whoever accesses the page will get the some_more_evil_code payload executed in their browser.

My suggested fix is to escape (sanitize) all dangerous output before presenting it to the user.

I found the bug while testing DeepCode’s AI Code Review. The tool can help you automate the process of finding such (and many other types of) bugs. You can sign-up your repo (free for Open Source) to receive notifications whenever new bugs are detected. You can give it a try here.

Any feedback is more than welcome at chibo@deepcode.ai.

Cheers, Victor.