CVE-2022-3371 (Python, published 2022-09-30T14:15Z)
Description: value: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
rdiffweb/controller/page_admin_users.py
rdiffweb/controller/page_pref_general.py
rdiffweb/controller/page_pref_tokens.py
rdiffweb/controller/tests/test_page_admin_users.py
rdiffweb/controller/tests/test_page_prefs_general.py
rdiffweb/controller/tests/test_page_prefs_tokens.py
Commit message: Limit user's fullname and Token name field length


Vulnerable code:
    fullname = StringField(_('Fullname'), validators=[validators.optional()])
from wtforms.validators import DataRequired, EqualTo, InputRequired, Length, Regexp
    fullname = StringField(_('Fullname'))
from wtforms.validators import DataRequired, Optional
        validators=[DataRequired()],
    def _add_user(self, username=None, email=None, password=None, user_root=None, role=None, mfa=None):

Fixed code:
    fullname = StringField(
        _('Fullname'),
        validators=[
            validators.optional(),
            validators.length(max=256, message=_('Fullname too long.')),
        ],
    )
from wtforms.validators import DataRequired, EqualTo, InputRequired, Length, Optional, Regexp
    fullname = StringField(
        _('Fullname'),
        validators=[
            Optional(),
            Length(max=256, message=_('Fullname too long.')),
        ],
    )
from wtforms.validators import DataRequired, Length, Optional
        validators=[
            DataRequired(),
            Length(max=256, message=_('Token name too long')),
        ],
    def _add_user(self, username=None, email=None, password=None, user_root=None, role=None, mfa=None, fullname=None):
        if fullname is not None:
            b['fullname'] = str(fullname)
    def test_add_with_fullname_too_long(self):
        # Given a too long user root
        fullname = "fullname" * 50
        # When trying to create the user
        self._add_user("test2", "test@test,com", "password", "/tmp/", UserObject.USER_ROLE, fullname=fullname)
        # Then an error is raised
        self.assertStatus(200)
        self.assertInBody("Fullname too long.")

    def test_change_fullname_too_long(self):
        # Given an authenticated user
        # When update the fullname
        self._set_profile_info("test@test.com", "Fullname" * 50)
        # Then page return with error message
        self.assertStatus(200)
        self.assertNotInBody("Profile updated successfully.")
        self.assertInBody("Fullname too long.")
        # Then database is not updated
        user = UserObject.query.filter(UserObject.username == self.USERNAME).first()
        self.assertEqual("", user.fullname)

    def test_add_access_token_with_name_too_long(self):
        # Given an existing user
        # When adding a new access token with name too long.
        self.getPage(
            "/prefs/tokens",
            method='POST',
            body={'action': 'add_access_token', 'name': 'token' * 52, 'expiration_time': ''},
        )
        # Then page return with error message
        self.assertStatus(200)
        # Then token name get displayed in the view
        self.assertInBody('Token name too long')