[OpenNMS/opennms] e4a2a1: NMS-20250: Render confirm-popover text with ng-bin...

  Branch: refs/heads/jira/NMS-20250-dependabot-coreweb-security-issues-august-2026-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: e4a2a1b34862a394a78c34be33b05bef0d68e0d2
      https://github.com/OpenNMS/opennms/commit/e4a2a1b34862a394a78c34be33b05bef0d68e0d2
  Author: Scott Theleman <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M core/web-assets/src/main/assets/js/apps/onms-classifications/views/modals/popover.html

  Log Message:
  -----------
  NMS-20250: Render confirm-popover text with ng-bind instead of ng-bind-html

The vendored angular-bootstrap-confirm popover template was the only
$sanitize sink in core/web-assets. Three call sites interpolate
user-controlled data into the popover message:

  onms-classifications/views/config.html:44  {{group.name}}
  onms-classifications/views/group.html:39   {{group.name}}
  onms-endpoints/grafana/grafana.html:39     {{endpoint.url}}, {{endpoint.uid}}

AngularJS 1.8.3 is EOL and its sanitizer permits SVG <image>
href/xlink:href and <source srcset> values, so a stored payload in a
classification group name or Grafana endpoint URL could load
attacker-chosen imagery into the delete-confirmation dialog of the next
admin who clicks delete (content spoofing; no script execution).

None of the four bindings need to render HTML -- every consumer passes
plain text (title, message, confirm-text="Yes", cancel-text="No"). Using
ng-bind removes the sink entirely rather than relying on the EOL
sanitizer, and closes the reachable path for CVE-2025-2336,
CVE-2025-0716 and CVE-2024-8373.

All three apps that use mwl-confirm (classifications, endpoints, reports)
require this same template, so one change covers every call site.



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs