CVE-2022-0578: Other (NVD-CWE-Other)
value: Code Injection in GitHub repository publify/publify prior to 9.2.8.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2022-05-16T15:15Z
Repository: https://github.com/publify/publify
Language: Ruby
Files changed: publify_core/app/models/feedback.rb, publify_core/spec/models/comment_spec.rb
Commit date: 2022-02-13 18:12:03 +0100
Commit message: Do not allow images in comments

Diff: diff --git a/publify_core/app/models/feedback.rb b/publify_core/app/models/feedback.rb
index 7bd363d1ae..e4b9d775d3 100644
--- a/publify_core/app/models/feedback.rb
+++ b/publify_core/app/models/feedback.rb
@@ -65,10 +65,14 @@ class Feedback < ApplicationRecord
   # FIXME: Inline this method
   def self.paginated(page, per_page)
     page(page).per(per_page)
   end
 
+  def self.allowed_tags
+    @allowed_tags ||= Rails::Html::SafeListSanitizer.allowed_tags - ["img"]
+  end
+
   def parent
     article
   end
 
   def classify_content
@@ -84,11 +88,11 @@ class Feedback < ApplicationRecord
     article.permalink_url("#{self.class.to_s.downcase}-#{id}", only_path)
   end
 
   def html_postprocess(_field, html)
     helper = ContentTextHelpers.new
-    helper.sanitize(helper.auto_link(html))
+    helper.sanitize(helper.auto_link(html), tags: self.class.allowed_tags)
   end
 
   def correct_url
     return if url.blank?
 
diff --git a/publify_core/spec/models/comment_spec.rb b/publify_core/spec/models/comment_spec.rb
index 2c6e3117d2..48890f2db3 100644
--- a/publify_core/spec/models/comment_spec.rb
+++ b/publify_core/spec/models/comment_spec.rb
@@ -266,10 +266,33 @@ describe Comment, type: :model do
           end
         end
       end
     end
 
+    context "with a comment containing some html" do
+      let(:comment) do
+        described_class.new do |c|
+          c.body = "Test <b>foo</b> <img src=\"https://eviloverlord.com/getmyip.jpg\">"
+          c.author = "Bob"
+          c.article = build_stubbed(:article, blog: blog)
+        end
+      end
+
+      ["", "textile", "markdown", "smartypants", "markdown smartypants"].each do |filter|
+        it "rejects images but not formatting with filter '#{filter}'" do
+          blog.comment_text_filter = filter
+
+          html = comment.html(:body)
+
+          ActiveSupport::Deprecation.silence do
+            expect(html).not_to match(/<img/)
+            expect(html).to match(%r{<b>foo</b>})
+          end
+        end
+      end
+    end
+
     context "with a markdown comment with italic and bold" do
       let(:comment) { build(:comment, body: "Comment body _italic_ **bold**") }
       let(:blog) { comment.article.blog }
 
       it "converts the comment markup to html" do

Vulnerable code:     helper.sanitize(helper.auto_link(html))
Fixed code:   def self.allowed_tags
    @allowed_tags ||= Rails::Html::SafeListSanitizer.allowed_tags - ["img"]
  end

    helper.sanitize(helper.auto_link(html), tags: self.class.allowed_tags)
    context "with a comment containing some html" do
      let(:comment) do
        described_class.new do |c|
          c.body = "Test <b>foo</b> <img src=\"https://eviloverlord.com/getmyip.jpg\">"
          c.author = "Bob"
          c.article = build_stubbed(:article, blog: blog)
        end
      end

      ["", "textile", "markdown", "smartypants", "markdown smartypants"].each do |filter|
        it "rejects images but not formatting with filter '#{filter}'" do
          blog.comment_text_filter = filter

          html = comment.html(:body)

          ActiveSupport::Deprecation.silence do
            expect(html).not_to match(/<img/)
            expect(html).to match(%r{<b>foo</b>})
          end
        end
      end
    end