pfSense: pfSense-SA-23_01.webgui: XSS vulnerability in the WebGUI

A potential Cross-Site Scripting (XSS) vulnerability was found in diag_edit.php,
a component of the pfSense Plus and pfSense CE software GUI.

The page did not sanitize the contents of filenames read from disk in the "file"
and "fqpn" variables, nor did it encode the output when it included those
values.

This problem is present on pfSense Plus version 22.05.1, pfSense CE version
2.6.0, and earlier versions of both.

N.B.: pfSense Plus version 22.05.1 included a partial fix which covered the
"file" parameter.

An authenticated user having sufficient access to create files with arbitrary
names on the firewall filesystem can break rendering of the page.

Exploit potential is minimized both by the fact that users with access to create
files typically already have root-level access and by the fact that "/" is not
valid in filenames, so tags cannot be closed. Even so, there is a theoretical
potential for XSS here, even if a viable exploit has not yet been discovered.

If this were exploitable, then due to the lack of proper encoding on the
affected parameters susceptible to XSS, arbitrary JavaScript could be executed
in the user's browser. The user's session cookie or other information from the
session may be compromised.