TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-04 23:45:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: sanitize output for email (#8373)

Browse Source 
# Which Problems Are Solved

ZITADEL uses HTML for emails and renders certain information such as
usernames dynamically. That information can be entered by users or
administrators. Due to a missing output sanitization, these emails could
include malicious code.
This may potentially lead to a threat where an attacker, without
privileges, could send out altered notifications that are part of the
registration processes. An attacker could create a malicious link, where
the injected code would be rendered as part of the email.

During investigation of this issue a related issue was found and
mitigated, where on the user's detail page the username was not
sanitized and would also render HTML, giving an attacker the same
vulnerability.

While it was possible to inject HTML including javascript, the execution
of such scripts would be prevented by most email clients and the Content
Security Policy in Console UI.

# How the Problems Are Solved

- All arguments used for email are sanitized (`html.EscapeString`)
- The email text no longer `html.UnescapeString` (HTML in custom text is
still possible)
- Console no longer uses `[innerHtml]` to render the username

# Additional Changes

None

# Additional Context

- raised via email

---------

Co-authored-by: peintnermax <max@caos.ch>
This commit is contained in:
Livio Spring 2024-07-31 14:21:10 +02:00 committed by GitHub
parent 918736c026
commit 189505c80f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
20 changed files with 39 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
console/src/app/modules/top-view/top-view.component.html
View File

@ -16,7 +16,7 @@
></div>
</div>
<div class="cnsl-doc-row">
<span class="cnsl-type" [innerHtml]="sub"></span>
<span class="cnsl-type">{{ sub }}</span>
<a *ngIf="docLink" mat-icon-button [href]="docLink" rel="noreferrer" target="_blank">
<mat-icon class="icon">info_outline</mat-icon>
</a>

2
console/src/app/modules/top-view/top-view.component.scss
View File

@ -82,7 +82,7 @@
.cnsl-type {
font-size: 14px;
margin-top: 2rem;
margin-top: 1.5rem;
margin-bottom: 1rem;
}

4
console/src/app/pages/projects/granted-projects/granted-project-detail/granted-project-detail.component.html
View File

@ -2,9 +2,7 @@
title="{{ project?.projectName }}"
[hasActions]="false"
docLink="https://zitadel.com/docs/guides/manage/console/projects#what-is-a-granted-project"
sub="{{ 'PROJECT.PAGES.TYPE.GRANTED_SINGULAR' | translate }} {{ 'ACTIONS.OF' | translate }} <strong>{{
project?.projectOwnerName
}}</strong>"
sub="{{ 'PROJECT.PAGES.TYPE.GRANTED_SINGULAR' | translate: { name: project?.projectOwnerName } }}"
[isActive]="project?.state === ProjectGrantState.PROJECT_GRANT_STATE_ACTIVE"
[isInactive]="project?.state === ProjectGrantState.PROJECT_GRANT_STATE_INACTIVE"
stateTooltip="{{ 'ORG.STATE.' + project?.state | translate }}"

2
console/src/assets/i18n/bg.json
View File

@ -1781,7 +1781,7 @@
"TYPE": {
"OWNED": "Притежавани проекти",
"OWNED_SINGULAR": "Собствен проект",
"GRANTED_SINGULAR": "Приет проект"
"GRANTED_SINGULAR": "Отпуснат проект на {{name}}"
},
"PRIVATELABEL": {
"0": {

2
console/src/assets/i18n/cs.json
View File

@ -1783,7 +1783,7 @@
"TYPE": {
"OWNED": "Vlastní projekty",
"OWNED_SINGULAR": "Vlastní projekt",
"GRANTED_SINGULAR": "Přidělený projekt"
"GRANTED_SINGULAR": "Projekt přidělený {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Nastavení brandingu",

2
console/src/assets/i18n/de.json
View File

@ -1782,7 +1782,7 @@
"TYPE": {
"OWNED": "Eigene Projekte",
"OWNED_SINGULAR": "Eigenes Projekt",
"GRANTED_SINGULAR": "Berechtigtes Projekt"
"GRANTED_SINGULAR": "Berechtigtes Projekt von {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Branding Verhalten",

2
console/src/assets/i18n/en.json
View File

@ -1782,7 +1782,7 @@
"TYPE": {
"OWNED": "Owned Projects",
"OWNED_SINGULAR": "Owned Project",
"GRANTED_SINGULAR": "Granted Project"
"GRANTED_SINGULAR": "Granted Project of {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Branding Setting",

2
console/src/assets/i18n/es.json
View File

@ -1783,7 +1783,7 @@
"TYPE": {
"OWNED": "Proyectos propios",
"OWNED_SINGULAR": "Proyecto propio",
"GRANTED_SINGULAR": "Proyecto concedido"
"GRANTED_SINGULAR": "Proyecto asignado {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Ajustes de imagen de marca",

2
console/src/assets/i18n/fr.json
View File

@ -1782,7 +1782,7 @@
"TYPE": {
"OWNED": "Projets possédés",
"OWNED_SINGULAR": "Projet possédé",
"GRANTED_SINGULAR": "Projet octroyé"
"GRANTED_SINGULAR": "Projet attribué à {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Image de marque",

2
console/src/assets/i18n/it.json
View File

@ -1782,7 +1782,7 @@
"TYPE": {
"OWNED": "Progetti proprietari",
"OWNED_SINGULAR": "Progetto proprietario",
"GRANTED_SINGULAR": "Progetto delegato"
"GRANTED_SINGULAR": "Progetto concesso di {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Impostazione branding",

2
console/src/assets/i18n/ja.json
View File

@ -1778,7 +1778,7 @@
"TYPE": {
"OWNED": "所有プロジェクト",
"OWNED_SINGULAR": "所有プロジェクト",
"GRANTED_SINGULAR": "グラントされたプロジェクト"
"GRANTED_SINGULAR": "{{name}}に付与されたプロジェクト"
},
"PRIVATELABEL": {
"TITLE": "ブランディング設定",

2
console/src/assets/i18n/mk.json
View File

@ -1783,7 +1783,7 @@
"TYPE": {
"OWNED": "Сопствени проекти",
"OWNED_SINGULAR": "Сопствен проект",
"GRANTED_SINGULAR": "Доделен проект"
"GRANTED_SINGULAR": "Проект доделен на {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Подесувања за брендирање",

2
console/src/assets/i18n/nl.json
View File

@ -1782,7 +1782,7 @@
"TYPE": {
"OWNED": "Eigen Projecten",
"OWNED_SINGULAR": "Eigen Project",
"GRANTED_SINGULAR": "Verleend Project"
"GRANTED_SINGULAR": "Project toegewezen {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Branding Instelling",

2
console/src/assets/i18n/pl.json
View File

@ -1781,7 +1781,7 @@
"TYPE": {
"OWNED": "Własne Projekty",
"OWNED_SINGULAR": "Własny Projekt",
"GRANTED_SINGULAR": "Udzielony Projekt"
"GRANTED_SINGULAR": "Projekt przydzielony {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Ustawienia marka",

2
console/src/assets/i18n/pt.json
View File

@ -1781,7 +1781,7 @@
"TYPE": {
"OWNED": "Projetos Próprios",
"OWNED_SINGULAR": "Projeto Próprio",
"GRANTED_SINGULAR": "Projeto Concedido"
"GRANTED_SINGULAR": "Projeto atribuído a {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Configuração de Marca",

3
console/src/assets/i18n/ru.json
View File

@ -1863,9 +1863,8 @@
"ZITADELPROJECT": "Это принадлежит проекту ZITADEL. Осторожно: Если вы внесёте изменения, ZITADEL может вести себя не так, как предполагалось.",
"TYPE": {
"OWNED": "Собственные проекты",
"GRANTED": "Проекты доступа",
"OWNED_SINGULAR": "Собственный проект",
"GRANTED_SINGULAR": "Допуск проекта"
"GRANTED_SINGULAR": "Проект, предоставленный {{name}}"
},
"PRIVATELABEL": {
"0": {

2
console/src/assets/i18n/sv.json
View File

@ -1786,7 +1786,7 @@
"TYPE": {
"OWNED": "Ägda Projekt",
"OWNED_SINGULAR": "Ägt Projekt",
"GRANTED_SINGULAR": "Beviljat Projekt"
"GRANTED_SINGULAR": "Projekt tilldelat {{name}}"
},
"PRIVATELABEL": {
"TITLE": "Varumärkesinställning",

2
console/src/assets/i18n/zh.json
View File

@ -1781,7 +1781,7 @@
"TYPE": {
"OWNED": "拥有的项目",
"OWNED_SINGULAR": "拥有项目",
"GRANTED_SINGULAR": "被授予的项目"
"GRANTED_SINGULAR": "授予{{name}}的项目"
},
"PRIVATELABEL": {
"TITLE": "品牌标识设置",

3
internal/notification/templates/templateData.go
View File

@ -2,7 +2,6 @@ package templates
import (
"fmt"
"html"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/i18n"
@ -40,7 +39,7 @@ func (data *TemplateData) Translate(translator *i18n.Translator, msgType string,
data.PreHeader = translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessagePreHeader), args, langs...)
data.Subject = translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessageSubject), args, langs...)
data.Greeting = translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessageGreeting), args, langs...)
data.Text = html.UnescapeString(translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessageText), args, langs...))
data.Text = translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessageText), args, langs...)
data.ButtonText = translator.Localize(fmt.Sprintf("%s.%s", msgType, domain.MessageButtonText), args, langs...)
// Footer text is neither included in i18n files nor defaults.yaml
footerText := fmt.Sprintf("%s.%s", msgType, domain.MessageFooterText)

20
internal/notification/types/notification.go
View File

@ -2,7 +2,9 @@ package types
import (
"context"
"html"
"github.com/zitadel/zitadel/internal/database"
"github.com/zitadel/zitadel/internal/eventstore"
"github.com/zitadel/zitadel/internal/i18n"
"github.com/zitadel/zitadel/internal/notification/channels/smtp"
@ -42,6 +44,7 @@ func SendEmail(
allowUnverifiedNotificationChannel bool,
) error {
args = mapNotifyUserToArgs(user, args)
sanitizeArgsForHTML(args)
data := GetTemplateData(ctx, translator, args, url, messageType, user.PreferredLanguage.String(), colors)
template, err := templates.GetParsedTemplate(mailhtml, data)
if err != nil {
@ -59,6 +62,23 @@ func SendEmail(
}
}
func sanitizeArgsForHTML(args map[string]any) {
for key, arg := range args {
switch a := arg.(type) {
case string:
args[key] = html.EscapeString(a)
case []string:
for i, s := range a {
a[i] = html.EscapeString(s)
}
case database.TextArray[string]:
for i, s := range a {
a[i] = html.EscapeString(s)
}
}
}
}
func SendSMSTwilio(
ctx context.Context,
channels ChannelChains,