TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-01-05 22:52:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: cherry pick security issue fixes (#1432)

Browse Source 
* fix: potential "Potentially unsafe external link" of TOS and EMail Links

* fix: "Size computation for allocation may overflow" by limiting aes encrypt to 64MB
This commit is contained in:
Livio Amstutz 2021-03-19 09:10:50 +01:00 committed by GitHub
parent bc7e650089
commit b01f277e4b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/crypto/aes.go
View File

@ -92,6 +92,10 @@ func EncryptAES(plainText []byte, key string) ([]byte, error) {
return nil, err return nil, err
} }
maxSize := 64 * 1024 * 1024
if len(plainText) > maxSize {
return nil, errors.ThrowPreconditionFailedf(nil, "CRYPT-AGg4t3", "data too large, max bytes: %v", maxSize)
}
cipherText := make([]byte, aes.BlockSize+len(plainText)) cipherText := make([]byte, aes.BlockSize+len(plainText))
iv := cipherText[:aes.BlockSize] iv := cipherText[:aes.BlockSize]
if _, err = io.ReadFull(rand.Reader, iv); err != nil { if _, err = io.ReadFull(rand.Reader, iv); err != nil {

2
internal/notification/static/templates/template.html
View File

@ -301,7 +301,7 @@
<td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;"> <td align="center" vertical-align="middle" style="font-size:0px;padding:10px 25px;word-break:break-word;">
<table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;"> <table border="0" cellpadding="0" cellspacing="0" role="presentation" style="border-collapse:separate;line-height:100%;">
<tr> <tr>
<td align="center" bgcolor="#5282C1" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#5282C1;" valign="middle"> <a href="{{.URL}}" style="display:inline-block;background:#5282C1;color:#ffffff;font-family:Ubuntu, Helvetica, Arial, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;" <td align="center" bgcolor="#5282C1" role="presentation" style="border:none;border-radius:3px;cursor:auto;mso-padding-alt:10px 25px;background:#5282C1;" valign="middle"> <a href="{{.URL}}" rel="noopener noreferrer" style="display:inline-block;background:#5282C1;color:#ffffff;font-family:Ubuntu, Helvetica, Arial, sans-serif;font-size:16px;font-weight:normal;line-height:120%;margin:0;text-decoration:none;text-transform:none;padding:10px 25px;mso-padding-alt:0px;border-radius:3px;"
target="_blank"> target="_blank">
{{.ButtonText}} {{.ButtonText}}
</a> </td> </a> </td>

2
internal/ui/login/static/templates/footer.html
View File

@ -1,7 +1,7 @@
{{define "footer"}} {{define "footer"}}
<footer> <footer>
<span class="fill-space"></span> <span class="fill-space"></span>
<a href="{{t "Footer.TosLink"}}" target="_blank" alt="Privacy Policy">{{t "Footer.TosPrivacyPolicy"}}</a> <a href="{{t "Footer.TosLink"}}" rel="noopener noreferrer" target="_blank" alt="Privacy Policy">{{t "Footer.TosPrivacyPolicy"}}</a>
<a href="https://docs.zitadel.ch/use" target="_black" alt="Help">{{t "Footer.Help"}}</a> <a href="https://docs.zitadel.ch/use" target="_black" alt="Help">{{t "Footer.Help"}}</a>
</footer> </footer>
{{end}} {{end}}

2
internal/ui/login/static/templates/register.html
View File

@ -86,7 +86,7 @@
name="register-term-confirmation" required> name="register-term-confirmation" required>
<label for="register-term-confirmation"> <label for="register-term-confirmation">
{{t "Registration.TosConfirm"}} {{t "Registration.TosConfirm"}}
<a class="tos-link" target="_blank" href="{{t "Registration.TosLink"}}"> <a class="tos-link" target="_blank" href="{{t "Registration.TosLink"}}" rel="noopener noreferrer">
{{t "Registration.TosLinkText"}} {{t "Registration.TosLinkText"}}
</a> </a>
</label> </label>

2
internal/ui/login/static/templates/register_org.html
View File

@ -75,7 +75,7 @@
name="register-term-confirmation" required> name="register-term-confirmation" required>
<label class="lgn-label" for="register-term-confirmation"> <label class="lgn-label" for="register-term-confirmation">
{{t "RegistrationOrg.TosConfirm"}} {{t "RegistrationOrg.TosConfirm"}}
<a class="tos-link" target="_blank" href="{{t "RegistrationOrg.TosLink"}}">{{t "RegistrationOrg.TosLinkText"}}</a> <a class="tos-link" target="_blank" href="{{t "RegistrationOrg.TosLink"}}" rel="noopener noreferrer">{{t "RegistrationOrg.TosLinkText"}}</a>
</label> </label>
</div> </div>
</div> </div>