Fix Stored XSS Vulnerability in Debug Toolbar (debugbar_time Parameter)!!

This PR addresses a stored XSS vulnerability in the Toolbar.php file of the Debug Toolbar system. The issue arises from improper sanitization and validation of the debugbar_time GET parameter, which is used to construct file paths and read their contents. If an attacker injects malicious JavaScript into a debugbar_*.json file, it could be executed when the debug toolbar is accessed, leading to potential security risks.

Issue Details:
Vulnerability:

The debugbar_time parameter was not properly validated, allowing attackers to inject malicious payloads.
The file contents were directly echoed back to the client without escaping, enabling stored XSS attacks.
Impact:

Session Hijacking: Attackers could steal session cookies of admins or users.
Persistent Malware Injection: Malicious scripts could persist in the debug logs and execute whenever accessed.
Privilege Escalation: If executed in a privileged session, attackers could perform unauthorized actions.

Fix Implemented:
1 . Input Validation: Added a preg_match() check to ensure the debugbar_time parameter only contains alphanumeric characters and underscores (^[a-zA-Z0-9_]+$).
This prevents malicious input from being used to construct file paths.

2. Output Escaping: Used htmlspecialchars() to escape special characters (<, >, ", ', &) in the file contents before echoing them back to the client.
This ensures that any potentially malicious content is rendered harmless in the browser.

3. File Existence and Readability Check:Added a check to ensure the file exists and is readable (is_file() and is_readable()) before attempting to read its contents.

Please review and merge this PR to address the security vulnerability.

Author: shwet04

system/Debug/Toolbar.php

@@ -484,25 +484,25 @@ public function respond()
         if ($request->getGet('debugbar_time')) {
             helper('security');
 
+            //Validate and sanitize the debugbar_time parameter -- ss
+            $debugbarTime= $request->getGet('debugbar_time');
+            if (!preg_match('/^[a-zA-Z0-9_]+$/', $debugbarTime)) {
+                throw new \InvalidArgumentException('Invalid debugbar_time parameter.');
+            }
+
             // Negotiate the content-type to format the output
             $format = $request->negotiate('media', ['text/html', 'application/json', 'application/xml']);
             $format = explode('/', $format)[1];
 
             $filename = sanitize_filename('debugbar_' . $request->getGet('debugbar_time'));
             $filename = WRITEPATH . 'debugbar/' . $filename . '.json';
 
-            if (is_file($filename)) {
+            if (is_file($filename) && is_readable($filename)) {
                 // Show the toolbar if it exists
-                echo $this->format(file_get_contents($filename), $format);
+                echo htmlspecialchars($this->format(file_get_contents($filename), $format), ENT_QUOTES, 'UTF-8');
 
                 exit;
             }
-
-            // Filename not found
-            http_response_code(404);
-
-            exit; // Exit here is needed to avoid loading the index page
-        }
     }
 
     /**