CVE-2023-1540: Observable Discrepancy (CWE-203)
value: Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/controller/user_controller.go, internal/service/user_service.go
Commit date: 2023-02-23 11:55:40 +0800
Commit message: fix(user): User reset password should not tell the user if the email exists.

Diff: diff --git a/internal/controller/user_controller.go b/internal/controller/user_controller.go
index c2cf25bfa..f69bc16e2 100644
--- a/internal/controller/user_controller.go
+++ b/internal/controller/user_controller.go
@@ -155,11 +155,11 @@ func (uc *UserController) RetrievePassWord(ctx *gin.Context) {
 		})
 		handler.HandleResponse(ctx, errors.BadRequest(reason.CaptchaVerificationFailed), errFields)
 		return
 	}
 	_, _ = uc.actionService.ActionRecordAdd(ctx, schema.ActionRecordTypeFindPass, ctx.ClientIP())
-	_, err := uc.userService.RetrievePassWord(ctx, req)
+	err := uc.userService.RetrievePassWord(ctx, req)
 	handler.HandleResponse(ctx, err, nil)
 }
 
 // UseRePassWord godoc
 // @Summary UseRePassWord
diff --git a/internal/service/user_service.go b/internal/service/user_service.go
index e7bd4374f..5026690ad 100644
--- a/internal/service/user_service.go
+++ b/internal/service/user_service.go
@@ -147,17 +147,17 @@ func (us *UserService) EmailLogin(ctx context.Context, req *schema.UserEmailLogi
 
 	return resp, nil
 }
 
 // RetrievePassWord .
-func (us *UserService) RetrievePassWord(ctx context.Context, req *schema.UserRetrievePassWordRequest) (string, error) {
+func (us *UserService) RetrievePassWord(ctx context.Context, req *schema.UserRetrievePassWordRequest) error {
 	userInfo, has, err := us.userRepo.GetByEmail(ctx, req.Email)
 	if err != nil {
-		return "", err
+		return err
 	}
 	if !has {
-		return "", errors.BadRequest(reason.UserNotFound)
+		return nil
 	}
 
 	// send email
 	data := &schema.EmailCodeContent{
 		Email:  req.Email,
@@ -165,14 +165,14 @@ func (us *UserService) RetrievePassWord(ctx context.Context, req *schema.UserRet
 	}
 	code := uuid.NewString()
 	verifyEmailURL := fmt.Sprintf("%s/users/password-reset?code=%s", us.getSiteUrl(ctx), code)
 	title, body, err := us.emailService.PassResetTemplate(ctx, verifyEmailURL)
 	if err != nil {
-		return "", err
+		return err
 	}
 	go us.emailService.SendAndSaveCode(ctx, req.Email, title, body, code, data.ToJSONString())
-	return code, nil
+	return nil
 }
 
 // UseRePassword
 func (us *UserService) UseRePassword(ctx context.Context, req *schema.UserRePassWordRequest) (resp *schema.GetUserResp, err error) {
 	data := &schema.EmailCodeContent{}

Vulnerable code: 	_, err := uc.userService.RetrievePassWord(ctx, req)
func (us *UserService) RetrievePassWord(ctx context.Context, req *schema.UserRetrievePassWordRequest) (string, error) {
		return "", err
		return "", errors.BadRequest(reason.UserNotFound)
		return "", err
	return code, nil
Fixed code: 	err := uc.userService.RetrievePassWord(ctx, req)
func (us *UserService) RetrievePassWord(ctx context.Context, req *schema.UserRetrievePassWordRequest) error {
		return err
		return nil
		return err
	return nil