IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: ERB execution in custom Email Style

Browse Source
This commit is contained in:
Robin Ward 2020-05-21 14:26:03 -04:00
parent 5a71c51ddd
commit d11c462104
3 changed files with 113 additions and 103 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/helpers/email_helper.rb
View File

@ -25,12 +25,8 @@ module EmailHelper
raw "<a href='#{Discourse.base_url}#{url}' style='color: ##{@anchor_color}'>#{title}</a>" raw "<a href='#{Discourse.base_url}#{url}' style='color: ##{@anchor_color}'>#{title}</a>"
end end
def email_html_template(binding_arg) def email_html_template
template = EmailStyle.new.html.sub( EmailStyle.new.html.sub('%{email_content}', yield).html_safe
'%{email_content}',
'<%= yield %><% if defined?(html_body) %><%= html_body %><% end %>'
)
ERB.new(template).result(binding_arg)
end end
protected protected

5
app/views/layouts/email_template.html.erb
View File

@ -2,5 +2,8 @@
<%= yield %> <%= yield %>
<% if defined?(html_body) %><%= html_body %><% end %> <% if defined?(html_body) %><%= html_body %><% end %>
<% else %> <% else %>
<%= email_html_template(binding).html_safe %> <%= email_html_template do %>
<%= yield %>
<% if defined?(html_body) %><%= html_body %><% end %>
<% end %>
<% end %> <% end %>

11
spec/integration/email_style_spec.rb
View File

@ -3,6 +3,16 @@
require "rails_helper" require "rails_helper"
describe EmailStyle do describe EmailStyle do
context "ERB evaluation" do
it "does not evaluate ERB outside of the email itself" do
SiteSetting.email_custom_template = "<div>%{email_content}</div><%= (111 * 333) %>"
html = Email::Renderer.new(UserNotifications.signup(Fabricate(:user))).html
expect(html).not_to match("36963")
end
end
context "with a custom template" do
before do before do
SiteSetting.email_custom_template = "<body><h1>FOR YOU</h1><div>%{email_content}</div></body>" SiteSetting.email_custom_template = "<body><h1>FOR YOU</h1><div>%{email_content}</div></body>"
SiteSetting.email_custom_css = 'h1 { color: red; } div.body { color: #FAB; }' SiteSetting.email_custom_css = 'h1 { color: red; } div.body { color: #FAB; }'
@ -127,4 +137,5 @@ describe EmailStyle do
expect(mail_html).to include(popular_topic.title) expect(mail_html).to include(popular_topic.title)
end end
end end
end
end end