From 8526f8f87784db822bd94b8a0dc03f9e35d4ce6c Mon Sep 17 00:00:00 2001
From: MaKyOtOx <nicolas.mattiocco@patrowl.io>
Date: Thu, 9 Dec 2021 14:51:07 +0100
Subject: [PATCH] Fix multiple XSS

---
 assets/templates/details-asset-group.html   |  2 +-
 assets/templates/details-asset.html         |  4 +-
 assets/templates/list-assets.html           |  5 +-
 common/utils/cpe.py                         |  2 +-
 engines/templates/list-engine-policies.html |  2 +-
 engines/templates/list-scan-engines.html    | 20 ++++----
 events/utils.py                             | 57 ++++++++++++++++-----
 findings/templates/list-findings.html       |  6 +--
 rules/templates/list-rules.html             |  2 +-
 scans/templates/add-scan-definition.html    | 13 +++--
 scans/templates/details-scan-def.html       |  4 +-
 scans/templates/details-scan.html           |  2 +-
 scans/templates/edit-scan-definition.html   | 24 +++++----
 scans/templates/list-scan-definitions.html  |  4 +-
 scans/templates/list-scans-performed.html   | 10 ++--
 settings/templates/menu-settings.html       |  8 +--
 templates/base.html                         | 11 +++-
 17 files changed, 112 insertions(+), 64 deletions(-)

diff --git a/assets/templates/details-asset-group.html b/assets/templates/details-asset-group.html
index 18473d3..ee03935 100644
--- a/assets/templates/details-asset-group.html
+++ b/assets/templates/details-asset-group.html
@@ -1102,7 +1102,7 @@ <h4 class="modal-title" id="myModalLabel">Add tags</h4>
       finding_id = e.relatedTarget.getAttribute('finding-id');
       finding_title = e.relatedTarget.getAttribute('finding-title');
       $("div#delete-finding").attr('finding-id', finding_id);
-      $("div#delete-finding").html("Finding: <b>"+finding_title+"</b><br/><br/>");
+      $("div#delete-finding").html("Finding: <b>"+encodeURIComponent(finding_title)+"</b><br/><br/>");
     });
     $("button.btn-delete-finding").on('click', function (e) {
       finding_id = $("div#delete-finding").attr('finding-id');
diff --git a/assets/templates/details-asset.html b/assets/templates/details-asset.html
index c339f83..c18c1c1 100644
--- a/assets/templates/details-asset.html
+++ b/assets/templates/details-asset.html
@@ -1202,7 +1202,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Scan</h4>
       finding_id = e.relatedTarget.getAttribute('finding-id');
       finding_title = e.relatedTarget.getAttribute('finding-title');
       $("div#delete-finding").attr('finding-id', finding_id);
-      $("div#delete-finding").html("Finding: <strong>"+finding_title+"</strong><br/><br/>");
+      $("div#delete-finding").html("Finding: <strong>"+encodeURIComponent(finding_title)+"</strong><br/><br/>");
     });
     $("button.btn-delete-finding").on('click', function (e) {
       finding_id = $("div#delete-finding").attr('finding-id');
@@ -1222,7 +1222,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Scan</h4>
       id = e.relatedTarget.getAttribute('scan-id');
       scan_title = e.relatedTarget.getAttribute('scan-title');
       $("div#delete-scan").attr('scan-id', id);
-      $("div#delete-scan").html("Title: <strong>"+scan_title+"</strong><br/><br/>");
+      $("div#delete-scan").html("Title: <strong>"+encodeURIComponent(scan_title)+"</strong><br/><br/>");
     });
     $("button.btn-delete-scan").on('click', function (e) {
       id = $("div#delete-scan").attr('scan-id');
diff --git a/assets/templates/list-assets.html b/assets/templates/list-assets.html
index 2cdebdf..d37e6a1 100644
--- a/assets/templates/list-assets.html
+++ b/assets/templates/list-assets.html
@@ -626,7 +626,7 @@ <h4 class="modal-title" id="myModalLabel">Update Assets</h4>
       id = e.relatedTarget.getAttribute('asset-id');
       asset_value = e.relatedTarget.getAttribute('asset-value');
       $("div#delete-asset").attr('asset-id', id);
-      $("div#delete-asset").html("Asset: <b>"+asset_value+"</b><br/><br/>");
+      $("div#delete-asset").html("Asset: <b>"+encodeURIComponent(asset_value)+"</b><br/><br/>");
     });
     $("button.btn-delete-asset").on('click', function (e) {
       id = $("div#delete-asset").attr('asset-id');
@@ -641,12 +641,13 @@ <h4 class="modal-title" id="myModalLabel">Update Assets</h4>
       });
     });
 
+
     // Delete asset group modal
     $("#modal-delete-asset-group").on('show.bs.modal', function (e) {
       id = e.relatedTarget.getAttribute('asset-group-id');
       asset_group_value = e.relatedTarget.getAttribute('asset-group-value');
       $("div#delete-asset-group").attr('asset-group-id', id);
-      $("div#delete-asset-group").html("Asset Group Name: <b>"+asset_group_value+"</b><br/><br/>");
+      $("div#delete-asset-group").html("Asset Group Name: <b>"+encodeURIComponent(asset_group_value)+"</b><br/><br/>");
     });
     $("button.btn-delete-asset-group").on('click', function (e) {
       id = $("div#delete-asset-group").attr('asset-group-id');
diff --git a/common/utils/cpe.py b/common/utils/cpe.py
index a83604f..3ab35f6 100644
--- a/common/utils/cpe.py
+++ b/common/utils/cpe.py
@@ -11,7 +11,7 @@ def extract_cpe(cpe_vector):
         vendor = c.get_vendor()[0]
         product = c.get_product()[0]
         print("-->", c, vendor, product)
-    except Except as e:
+    except Exception as e:
         print(e)
 
     return vendor, product
diff --git a/engines/templates/list-engine-policies.html b/engines/templates/list-engine-policies.html
index b78d5ea..a83ccf3 100644
--- a/engines/templates/list-engine-policies.html
+++ b/engines/templates/list-engine-policies.html
@@ -185,7 +185,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Policy</h4>
       policy_id = e.relatedTarget.getAttribute('policy-id');
       policy_name = e.relatedTarget.getAttribute('policy-name');
       $("div#delete-policy").attr('policy-id', policy_id);
-      $("div#delete-policy").html("Policy: <b>"+policy_name+"</b><br/><br/>");
+      $("div#delete-policy").html("Policy: <b>"+encodeURIComponent(policy_name)+"</b><br/><br/>");
     });
     $("button.btn-delete-policy").on('click', function (e) {
       policy_id = $("div#delete-policy").attr('policy-id');
diff --git a/engines/templates/list-scan-engines.html b/engines/templates/list-scan-engines.html
index 79662b0..21a7174 100644
--- a/engines/templates/list-scan-engines.html
+++ b/engines/templates/list-scan-engines.html
@@ -196,20 +196,20 @@ <h4 class="modal-title" id="myModalLabel">Engine info</h4>
           $("div#info-engine").html("Loading...");
         },
         success: function(data, textStatus, jqXHR){
-          info_data = "Engine: <strong>"+data["engine"]["name"]+"</strong><br/>";
-          info_data+= "API URL: <strong>"+data["engine"]["api_url"]+"</strong><br/>";
+          info_data = "Engine: <strong>"+encodeURIComponent(data["engine"]["name"])+"</strong><br/>";
+          info_data+= "API URL: <strong>"+encodeURIComponent(data["engine"]["api_url"])+"</strong><br/>";
 
           if(data["engine_infos"]["status"] == "ERROR") {
             info_data+= "Oper status: <strong>ERROR</strong><br/>";
             if(data["engine_infos"]["details"]){
-              info_data+= "Request: <strong>"+data["engine_infos"]["details"]["request"]+"</strong></br>"
-              info_data+= "Reason: <strong>"+data["engine_infos"]["details"]["reason"]+"</strong></br>"
+              info_data+= "Request: <strong>"+encodeURIComponent(data["engine_infos"]["details"]["request"])+"</strong></br>"
+              info_data+= "Reason: <strong>"+encodeURIComponent(data["engine_infos"]["details"]["reason"])+"</strong></br>"
             }
           } else {
-            info_data+= "Nb scans: <strong>"+data["nb_scans"]+"</strong><br/>";
-            info_data+= "Oper status: <strong>"+data["engine_infos"]["engine_config"]["status"]+"</strong><br/>";
-            info_data+= "Version: <strong>"+data["engine_infos"]["engine_config"]["version"]+"</strong><br/>";
-            info_data+= "Description: <strong>"+data["engine_infos"]["engine_config"]["description"]+"</strong><br/>";
+            info_data+= "Nb scans: <strong>"+encodeURIComponent(data["nb_scans"])+"</strong><br/>";
+            info_data+= "Oper status: <strong>"+encodeURIComponent(data["engine_infos"]["engine_config"]["status"])+"</strong><br/>";
+            info_data+= "Version: <strong>"+encodeURIComponent(data["engine_infos"]["engine_config"]["version"])+"</strong><br/>";
+            info_data+= "Description: <strong>"+encodeURIComponent(data["engine_infos"]["engine_config"]["description"])+"</strong><br/>";
 
             current_scans=data["current_scans"];
             if (current_scans == null || Object.keys(current_scans).length === 0) {
@@ -219,7 +219,7 @@ <h4 class="modal-title" id="myModalLabel">Engine info</h4>
               for (var scan in current_scans){
                 if (current_scans.hasOwnProperty(scan)) {
                   scan_id = Object.keys(current_scans[scan])[0];
-                  info_data+= " * id="+scan_id+", started_at: "+new Date(current_scans[scan][scan_id]["started_at"])+", status: "+current_scans[scan][scan_id]["status"]+" <br/>";
+                  info_data+= " * id="+scan_id+", started_at: "+new Date(current_scans[scan][scan_id]["started_at"])+", status: "+encodeURIComponent(current_scans[scan][scan_id]["status"])+" <br/>";
                 }
               }
             }
@@ -235,7 +235,7 @@ <h4 class="modal-title" id="myModalLabel">Engine info</h4>
       engine_id = e.relatedTarget.getAttribute('engine-id');
       engine_name = e.relatedTarget.getAttribute('engine-name');
       $("div#delete-engine").attr('engine-id', engine_id);
-      $("div#delete-engine").html("Engine: <strong>"+engine_name+"</strong><br/><br/>");
+      $("div#delete-engine").html("Engine: <strong>"+encodeURIComponent(engine_name)+"</strong><br/><br/>");
     });
     $("button.btn-delete-engine").on('click', function (e) {
       engine_id = $("div#delete-engine").attr('engine-id');
diff --git a/events/utils.py b/events/utils.py
index 712cc04..a859d1f 100644
--- a/events/utils.py
+++ b/events/utils.py
@@ -2,6 +2,7 @@
 from findings.models import Finding
 from assets.models import Asset
 from rules.models import Rule
+from common.utils import cpe
 
 
 def _evaluate_alert_rules(finding, highest_severity="info"):
@@ -79,25 +80,57 @@ def generate_finding_alert(finding_id, scan_id, severity="info", action="new_fin
         asset_id = asset.id
         asset_type = asset.type
 
+    # Prepare alert metadata
+    metadata = {
+        "finding_id": finding.id,
+        "finding_title": finding.title,
+        "finding_description": finding.description,
+        "finding_tags": finding.tags,
+        "finding_cves": [],
+        "finding_cpes": [],
+        "scan_id": scan_id,
+        "scan_definition_id": finding.scan.scan_definition.id,
+        "asset_name": finding.asset_name,
+        "asset_type": asset_type,
+        "asset_id": asset_id,
+        "asset_tags": [t.value for t in finding.asset.categories.all()],
+    }
+
+    # Add CVE if any
+    if 'CVE' in finding.vuln_refs.keys():
+        try:
+            if type(finding.vuln_refs['CVE']) is list:
+                metadata.update({'finding_cves': finding.vuln_refs['CVE']})
+            else:
+                metadata.update({'finding_cves': [finding.vuln_refs['CVE']]})
+        except Exception:
+            pass
+
+    # Add CPE/Vendor/Product
+    if 'CPE' in finding.vuln_refs.keys():
+        try:
+            for c in finding.vuln_refs['CPE']:
+                for cc in c.split('\n'):
+                    vendor, product = cpe.extract_cpe(cc)
+                    metadata.update({'finding_cpes': {
+                        'vector': cc,
+                        'vendor': vendor,
+                        'product': product,
+                    }})
+        except Exception:
+            pass
+
+    # Create alert
     alert = Alert.objects.create(
         message=alert_message,
         type=alert_type,
         status='new',
         severity=severity,
-        metadata={
-            "finding_id": finding.id,
-            "finding_title": finding.title,
-            "finding_description": finding.description,
-            "finding_tags": finding.tags,
-            "scan_id": scan_id,
-            "scan_definition_id": finding.scan.scan_definition.id,
-            "asset_name": finding.asset_name,
-            "asset_type": asset_type,
-            "asset_id": asset_id,
-            "asset_tags": [t.value for t in finding.asset.categories.all()],
-        },
+        metadata=metadata,
         owner=finding.owner
     )
+
+    # Update Teams
     if finding.asset.teams.count() > 0:
         for team in finding.asset.teams.all():
             alert.teams.add(team)
diff --git a/findings/templates/list-findings.html b/findings/templates/list-findings.html
index 73c65b1..f70d537 100644
--- a/findings/templates/list-findings.html
+++ b/findings/templates/list-findings.html
@@ -715,9 +715,9 @@ <h4 class="modal-title" id="myModalLabel">Filter findings</h4>
       finding_severity = e.relatedTarget.getAttribute('finding-severity');
       $("div#delete-finding").attr('finding-id', finding_id);
       $("div#delete-finding").html(
-				"Title: <b>"+finding_title+"</b><br/> \
-				Asset: <b>"+finding_asset+"</b><br/> \
-				Severity: <b>"+finding_severity+"</b><br/><br/>"
+				"Title: <b>"+encodeURIComponent(finding_title)+"</b><br/> \
+				Asset: <b>"+encodeURIComponent(finding_asset)+"</b><br/> \
+				Severity: <b>"+encodeURIComponent(finding_severity)+"</b><br/><br/>"
 			);
     });
     $("button.btn-delete-finding").on('click', function (e) {
diff --git a/rules/templates/list-rules.html b/rules/templates/list-rules.html
index c392560..431c97f 100644
--- a/rules/templates/list-rules.html
+++ b/rules/templates/list-rules.html
@@ -372,7 +372,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Rule ?</h4>
       rule_id = e.relatedTarget.getAttribute('rule-id');
       rule_title = e.relatedTarget.getAttribute('rule-title');
       $("div#delete-rule").attr('rule-id', rule_id);
-      $("div#delete-rule").html("Name: <b>"+rule_title+"</b><br/>");
+      $("div#delete-rule").html("Name: <b>"+encodeURIComponent(rule_title)+"</b><br/>");
     });
     $("button.btn-delete-rule").on('click', function (e) {
       delete_rule_args = {
diff --git a/scans/templates/add-scan-definition.html b/scans/templates/add-scan-definition.html
index 5d61acd..615a8be 100644
--- a/scans/templates/add-scan-definition.html
+++ b/scans/templates/add-scan-definition.html
@@ -220,6 +220,9 @@
   </form>
 </div>
 
+{{ scan_policies_json|json_script:"scan_policies_json_script" }}
+{{ engine_list|json_script:"engine_list_script" }}
+
 <script>
 
   _selected_assets = [];
@@ -409,23 +412,23 @@
           _selected_assets.push(datum["value"]);
           _id_asset += 1;
           $('div.cbx_assets').append("<label for='id_assets_list_"+_id_asset+"' class='custom-control-label'>\
-            <input id='id_assets_list_"+_id_asset+"' class='custom-control-input' name='assets_list' type='checkbox' value='"+datum["id"]+"' asset-type='"+datum["type"]+"'checked/> "+e.target.value+"</label><br/>");
+            <input id='id_assets_list_"+_id_asset+"' class='custom-control-input' name='assets_list' type='checkbox' value='"+datum["id"]+"' asset-type='"+datum["type"]+"'checked/> "+encodeURIComponent(e.target.value)+"</label><br/>");
         } else if (datum["format"] == "taggroup") {
         _selected_assets.push(datum["value"]);
           _id_asset += 1;
           $('div.cbx_assets').append("<label for='id_taggroups_list_"+_id_asset+"' class='custom-control-label'>\
-            <input id='id_taggroups_list_"+_id_asset+"' class='custom-control-input' name='taggroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+e.target.value+" (tag)</label><br/>");
+            <input id='id_taggroups_list_"+_id_asset+"' class='custom-control-input' name='taggroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+encodeURIComponent(e.target.value)+" (tag)</label><br/>");
          } else {
           _selected_assets.push(datum["value"]);
           _id_asset += 1;
           $('div.cbx_assets').append("<label for='id_assetgroups_list_"+_id_asset+"' class='custom-control-label'>\
-            <input id='id_assetgroups_list_"+_id_asset+"' class='custom-control-input' name='assetgroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+e.target.value+" (group)</label><br/>");
+            <input id='id_assetgroups_list_"+_id_asset+"' class='custom-control-input' name='assetgroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+encodeURIComponent(e.target.value)+" (group)</label><br/>");
         }
       }
     });
 
     // Filter scan policy by engines & categories
-    var policies_list = {{ scan_policies_json | safe }};
+    var policies_list = JSON.parse(document.getElementById('scan_policies_json_script').textContent);
     var hidden_policies_by_cat = [];
     var hidden_policies_by_engine = [];
     $('#category-buttons').bind('change', function(e){
@@ -502,7 +505,7 @@
     });
 
     // List appropriate engine instances depending on scan policy
-    engine_list = {{scan_engines_json|safe}}
+    engine_list = JSON.parse(document.getElementById('engine_list_script').textContent);
     $("[name='engine_policy']").change(function(e){
       engine_name = e.currentTarget.getAttribute('engine-name');
       $('select#id_engine').empty();
diff --git a/scans/templates/details-scan-def.html b/scans/templates/details-scan-def.html
index c75faea..d8affd1 100644
--- a/scans/templates/details-scan-def.html
+++ b/scans/templates/details-scan-def.html
@@ -581,7 +581,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Scan</h4>
   // Run direct scan now Event
   $("#modal-run-scan").on('show.bs.modal', function (e) {
     scan_title = e.relatedTarget.getAttribute('scan-title');
-    $("div#run-scan").html("Scan started: <b>"+scan_title+"</b><br/><br/>");
+    $("div#run-scan").html("Scan started: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
 
     //Hide the modal 3 seconds later
     var myModal = $(this);
@@ -682,7 +682,7 @@ <h4 class="modal-title" id="myModalLabel">Delete Scan</h4>
     id = e.relatedTarget.getAttribute('scan-id');
     scan_title = e.relatedTarget.getAttribute('scan-title');
     $("div#delete-scan").attr('scan-id', id);
-    $("div#delete-scan").html("ID: <b>"+id+"</b><br/>Title: <b>"+scan_title+"</b><br/><br/>");
+    $("div#delete-scan").html("ID: <b>"+id+"</b><br/>Title: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
   });
   $("button.btn-delete-scan").on('click', function (e) {
     id = $("div#delete-scan").attr('scan-id');
diff --git a/scans/templates/details-scan.html b/scans/templates/details-scan.html
index 5ecd86d..5900fa9 100644
--- a/scans/templates/details-scan.html
+++ b/scans/templates/details-scan.html
@@ -848,7 +848,7 @@ <h4 class="modal-title" id="myModalLabel">Retest a finding</h4>
         $("div#retest-finding").append('\
         <div class="alert alert-dismissible alert-danger">\
           <button type="button" class="close" data-dismiss="alert">&times;</button>\
-          <strong>Error:</strong> Unable to retest finding: '+data.reason+'.\
+          <strong>Error:</strong> Unable to retest finding: '+encodeURIComponent(data.reason)+'.\
         </div>');
         setTimeout(function(){
           $("div#retest-finding div.alert-danger").remove();
diff --git a/scans/templates/edit-scan-definition.html b/scans/templates/edit-scan-definition.html
index 9180403..7db9de1 100644
--- a/scans/templates/edit-scan-definition.html
+++ b/scans/templates/edit-scan-definition.html
@@ -218,6 +218,10 @@
   </form>
 </div>
 
+{{ scan_policies_json|json_script:"scan_policies_json_script" }}
+{{ engine_list|json_script:"engine_list_script" }}
+
+
 <script>
 
 _selected_team = '';
@@ -322,20 +326,20 @@
   $("input:radio[name='engine_policy'][value='{{scan_def.engine_policy.id}}']").attr("checked", "checked");
 
   // - Engine
-  engine_list = {{scan_engines_json|safe}}
+  engine_list = JSON.parse(document.getElementById('engine_list_script').textContent);
   $('select#id_engine').append("<option value='-1' selected>---- random (by default) ----</option>");
   for (i = 0; i< engine_list.length; i++){
     if(engine_list[i]["engine__name"] == "{{scan_def.engine_type.name}}"){
       $('select#id_engine').append($('<option>', {
           value: engine_list[i]['id'],
-          text: engine_list[i]['name']
+          text: encodeURIComponent(engine_list[i]['name'])
         })
       );
     }
 
   }
   if("{{scan_def.engine}}" != "None"){
-    $("select#id_engine option[value='{{scan_def.engine.id}}']").attr('selected','selected');
+    $("select#id_engine option[value='{{scan_def.engine.id}}']").attr('selected', 'selected');
   }
 
 }
@@ -480,15 +484,15 @@
       // append the asset to the list
       if (_selected_assets.indexOf(datum["value"]) == -1){
         if (datum["format"] == "asset") {
-          _selected_assets.push(datum["value"]);
+          _selected_assets.push(encodeURIComponent(datum["value"]));
           _id_asset += 1;
           $('div.cbx_assets').append("<label for='id_assets_list_"+_id_asset+"' class='custom-control-label'>\
-            <input id='id_assets_list_"+_id_asset+"' class='custom-control-input' name='assets_list' type='checkbox' value='"+datum["id"]+"' asset-type='"+datum["type"]+"' checked/> "+e.target.value+"</label><br/>");
+            <input id='id_assets_list_"+_id_asset+"' class='custom-control-input' name='assets_list' type='checkbox' value='"+datum["id"]+"' asset-type='"+datum["type"]+"' checked/> "+encodeURIComponent(e.target.value)+"</label><br/>");
         } else {
-          _selected_assets.push(datum["value"]);
+          _selected_assets.push(encodeURIComponent(datum["value"]));
           _id_asset += 1;
           $('div.cbx_assets').append("<label for='id_assetgroups_list_"+_id_asset+"' class='custom-control-label'>\
-            <input id='id_assetgroups_list_"+_id_asset+"' class='custom-control-input' name='assetgroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+e.target.value+" (group)</label><br/>");
+            <input id='id_assetgroups_list_"+_id_asset+"' class='custom-control-input' name='assetgroups_list' type='checkbox' value='"+datum["id"]+"' checked/> "+encodeURIComponent(e.target.value)+" (group)</label><br/>");
         }
       }
     });
@@ -542,7 +546,7 @@
     // });
 
     // List appropriate engine instances depending on scan policy
-    engine_list = {{scan_engines_json|safe}}
+    engine_list = JSON.parse(document.getElementById('engine_list_script').textContent);
     $("[name='engine_policy']").change(function(e){
       engine_name = e.currentTarget.getAttribute('engine-name');
       $('select#id_engine').empty();
@@ -551,7 +555,7 @@
         if(engine_list[i]["engine__name"] == engine_name){
           $('select#id_engine').append($('<option>', {
               value: engine_list[i]['id'],
-              text: engine_list[i]['name']
+              text: encodeURIComponent(engine_list[i]['name'])
             })
           );
         }
@@ -591,7 +595,7 @@
 }
 
 // global variables
-var policies_list = {{ scan_policies_json | safe }};
+var policies_list = JSON.parse(document.getElementById('scan_policies_json_script').textContent);
 var hidden_policies_by_cat = [];
 var hidden_policies_by_engine = [];
 
diff --git a/scans/templates/list-scan-definitions.html b/scans/templates/list-scan-definitions.html
index 28cc39d..3a3c1ef 100644
--- a/scans/templates/list-scan-definitions.html
+++ b/scans/templates/list-scan-definitions.html
@@ -244,7 +244,7 @@ <h4 class="modal-title" id="myModalLabel">Direct Scan</h4>
     // Run direct scan now Event
     $("#modal-run-scan").on('show.bs.modal', function (e) {
       scan_title = e.relatedTarget.getAttribute('scan-title');
-      $("div#run-scan").html("Scan started: <b>"+scan_title+"</b><br/><br/>");
+      $("div#run-scan").html("Scan started: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
 
       //Hide the modal 3 seconds later
       var myModal = $(this);
@@ -283,7 +283,7 @@ <h4 class="modal-title" id="myModalLabel">Direct Scan</h4>
       scan_id = e.relatedTarget.getAttribute('scan-id');
       scan_title = e.relatedTarget.getAttribute('scan-title');
       $("div#delete-scan-def").attr('scan-id', scan_id);
-      $("div#delete-scan-def").html("Title: <b>"+scan_title+"</b><br/><br/>");
+      $("div#delete-scan-def").html("Title: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
     });
     $("button.btn-delete-scan-def").on('click', function (e) {
       scan_id = $("div#delete-scan-def").attr('scan-id');
diff --git a/scans/templates/list-scans-performed.html b/scans/templates/list-scans-performed.html
index b0e5fb6..d8acd33 100644
--- a/scans/templates/list-scans-performed.html
+++ b/scans/templates/list-scans-performed.html
@@ -467,7 +467,7 @@ <h4 class="modal-title" id="myModalLabel">Filter Scan</h4>
         for (i = 0; i < data.length; ++i){
           scan_row_html = "<tr class='dblclickable-row' data-href='/scans/details/"+data[i]["scan_id"]+"'>\
             <td><input type='checkbox' class='radio' name='scan' value='"+data[i]["scan_id"]+"'/></td>\
-            <td><a href='/scans/details/"+data[i]["scan_id"]+"'>["+data[i]["engine_type"]+"] "+data[i]["title"]+"</a></td>"
+            <td><a href='/scans/details/"+data[i]["scan_id"]+"'>["+encodeURIComponent(data[i]["engine_type"])+"] "+encodeURIComponent(data[i]["title"])+"</a></td>"
             //<td><a href='/scans/defs/details/"+data[i]["scan_definition_id"]+"'>["+data[i]["engine_type"]+"] "+data[i]["title"]+"</a></td>"
 
           if (data[i]["status"] == "started"){
@@ -509,10 +509,10 @@ <h4 class="modal-title" id="myModalLabel">Filter Scan</h4>
             <button type='button' class='btn btn-default btn-xs' title='Details' onclick='location.href=\"/scans/details/"+data[i]["scan_id"]+"\"'>details</button>\
               <button type='button' class='btn btn-default btn-xs' title='Export scan findings' onclick='location.href=\"/scans/api/v1/report/html/"+data[i]["scan_id"]+"\"'>\
                 <span class='glyphicon glyphicon-share'></span></button>\
-              <button type='button' class='btn btn-warning btn-xs btn-run-now' scan-id='"+data[i]["scan_definition_id"]+"' scan-title='"+data[i]["title"]+"' data-toggle='modal' data-target='#modal-run-scan'>\
+              <button type='button' class='btn btn-warning btn-xs btn-run-now' scan-id='"+data[i]["scan_definition_id"]+"' scan-title='"+encodeURIComponent(data[i]["title"])+"' data-toggle='modal' data-target='#modal-run-scan'>\
                 Run </button>\
               <button type='button' class='btn btn-danger btn-xs' data-toggle='modal' data-target='#modal-delete-scan'\
-                scan-id='"+data[i]["scan_id"]+"' scan-title='"+data[i]["title"]+" ["+data[i]["engine_type"]+"]'>\
+                scan-id='"+data[i]["scan_id"]+"' scan-title='"+encodeURIComponent(data[i]["title"])+" ["+encodeURIComponent(data[i]["engine_type"])+"]'>\
                 <span class='glyphicon glyphicon-remove'></button></td>\
           </tr>";
           $("div.container.all-scans table tbody").append(scan_row_html);
@@ -592,7 +592,7 @@ <h4 class="modal-title" id="myModalLabel">Filter Scan</h4>
     // Run direct scan now Event
     $("#modal-run-scan").on('show.bs.modal', function (e) {
       scan_title = e.relatedTarget.getAttribute('scan-title');
-      $("div#run-scan").html("Scan started: <b>"+scan_title+"</b><br/><br/>");
+      $("div#run-scan").html("Scan started: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
 
       //Hide the modal 3 seconds later
       var myModal = $(this);
@@ -613,7 +613,7 @@ <h4 class="modal-title" id="myModalLabel">Filter Scan</h4>
       id = e.relatedTarget.getAttribute('scan-id');
       scan_title = e.relatedTarget.getAttribute('scan-title');
       $("div#delete-scan").attr('scan-id', id);
-      $("div#delete-scan").html("Title: <b>"+scan_title+"</b><br/><br/>");
+      $("div#delete-scan").html("Title: <b>"+encodeURIComponent(scan_title)+"</b><br/><br/>");
     });
     $("button.btn-delete-scan").on('click', function (e) {
       id = $("div#delete-scan").attr('scan-id');
diff --git a/settings/templates/menu-settings.html b/settings/templates/menu-settings.html
index 607fa50..ce80915 100644
--- a/settings/templates/menu-settings.html
+++ b/settings/templates/menu-settings.html
@@ -327,7 +327,7 @@ <h4 class="modal-title" id="myModalLabel">Add new setting</h4>
     id = e.relatedTarget.getAttribute('setting-id');
     key = e.relatedTarget.getAttribute('setting-key');
     $("div#delete-setting").attr('setting-id', id);
-    $("div#delete-setting").html("Setting: <b>"+key+"</b><br/><br/>");
+    $("div#delete-setting").html("Setting: <b>"+encodeURIComponent(key)+"</b><br/><br/>");
   });
   $("button.btn-delete-setting").on('click', function (e) {
     id = $("div#delete-setting").attr('setting-id');
@@ -365,7 +365,7 @@ <h4 class="modal-title" id="myModalLabel">Add new setting</h4>
     setting_id=e.delegateTarget.getAttribute("setting-id");
     setting_value=$('div#setting_value_'+setting_id+' i').text();
     $('div#setting_value_'+setting_id).empty();
-    $('div#setting_value_'+setting_id).append("<input type='text' value='"+setting_value+"' name='setting_value' class='form-control form-control-sm'/>");
+    $('div#setting_value_'+setting_id).append("<input type='text' value='"+encodeURIComponent(setting_value)+"' name='setting_value' class='form-control form-control-sm'/>");
 
     //On Enter key press, update the field
     $('input[name="setting_value"]').keyup(function(e){
@@ -388,7 +388,7 @@ <h4 class="modal-title" id="myModalLabel">Add new setting</h4>
          success: function(){
            location.reload();
            $('div#setting_value_'+setting_id).empty();
-           $('div#setting_value_'+setting_id).append("<i>"+e.target.value+"</i>");
+           $('div#setting_value_'+setting_id).append("<i>"+encodeURIComponent(e.target.value)+"</i>");
          }
        });
     });
@@ -396,7 +396,7 @@ <h4 class="modal-title" id="myModalLabel">Add new setting</h4>
        setting_id = e.target.parentElement.getAttribute("setting-id");
        setting_value = e.target.getAttribute("value");
        $('div#setting_value_'+setting_id).empty();
-       $('div#setting_value_'+setting_id).append("<i>"+setting_value+"</i>");
+       $('div#setting_value_'+setting_id).append("<i>"+encodeURIComponent(setting_value)+"</i>");
     });
   };
 
diff --git a/templates/base.html b/templates/base.html
index 699263a..0374062 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -76,6 +76,13 @@
         window.history.back();
     }
 
+    function encodeURIComponent(str){
+      return String(str).replace(/[^\w. ]/gi, function(c){
+         return '\\u'+('0000'+c.charCodeAt(0).toString(16)).slice(-4);
+      });
+
+    }
+
     $(function(){
       $(".clickable-row").click(function() {
         var sel = getSelection().toString();
@@ -121,7 +128,7 @@
           engine = engines_json[engine_id];
           enabled = ""
           if (engine["enabled"] == true) {enabled = "Enabled";} else {enabled="Disabled"}
-          title = engine["name"] + " ("+enabled+"/"+engine["status"]+")";
+          title = encodeURIComponent(engine["name"]) + " ("+enabled+"/"+engine["status"]+")";
           status_color = "default";
           if (engine["enabled"] && engine["status"] == "READY" || engine["status"] == "WORKING") {
             status_color = "success";
@@ -484,7 +491,7 @@
               {% if PRO_EDITION %}
                 <!-- <li><a href="/users/pro/list"><span class="glyphicon glyphicon-th-list"></span> Users</a></li> -->
                 {% if request.user.is_superuser or request.user|is_team_admin == True %}
-                <li><a href="/users/pro/list"><span class="glyphicon glyphicon-th-list"></span> Users</a></li>
+                <li><a href="/users/list"><span class="glyphicon glyphicon-th-list"></span> Users</a></li>
                 {% else %}
                 <li><a href="#"><span class="glyphicon glyphicon-th-list"></span> Users (Admin only)</a></li>
                 {% endif %}