CVE-2023-0440 (Python, published 2023-01-23T14:15Z)
Description: value: Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/healthchecks/healthchecks
Files changed:
CHANGELOG.md
hc/accounts/forms.py
hc/accounts/tests/test_login.py
hc/accounts/tests/test_signup.py
hc/accounts/views.py
templates/accounts/login_link_sent.html
templates/accounts/signup_result.html
Commit message: Fix login and signup views to make email enumeration harder


Vulnerable code:
        if User.objects.filter(email=v).exists():
            raise forms.ValidationError(
                "An account with this email address already exists."
            )

            raise forms.ValidationError("Unknown email address.")
        self.assertContains(r, "Account created")
    def test_it_checks_for_existing_users(self):
        self.assertContains(r, "already exists")
        self.assertContains(r, "Account created")
                profile = Profile.objects.for_user(magic_form.user)
                profile.send_instant_login_link(redirect_url=redirect_url)
                response = redirect("hc-login-link-sent")
        tz = form.cleaned_data["tz"]
        user = _make_user(email, tz)
        profile = Profile.objects.for_user(user)
        profile.send_instant_login_link()
        ctx["created"] = True
    if ctx.get("created"):
            <h1>Login Link Sent!</h1>
                We've sent you an email with login instructions.
                Please check your inbox!

{% endfor %}

{% if created %}
<p class="text-success">Account created, please check your email!</p>
{% endif %}

Fixed code:
- Fix login and signup views to make email enumeration harder
            self.user = None
    def test_it_handles_unknown_email(self):
        form = {"identity": "surprise@example.org"}

        r = self.client.post("/accounts/login/", form)
        self.assertRedirects(r, "/accounts/login_link_sent/")
        self.assertIn("auto-login", r.cookies)

        # There should be no sent emails.
        self.assertEqual(len(mail.outbox), 0)

        self.assertContains(r, "check your email")
    def test_it_handles_existing_users(self):
        self.assertContains(r, "check your email")
        self.assertIn("auto-login", r.cookies)

        # It should not send an email
        self.assertEqual(len(mail.outbox), 0)
        self.assertContains(r, "check your email")
                if magic_form.user:
                    profile = Profile.objects.for_user(magic_form.user)
                    profile.send_instant_login_link(redirect_url=redirect_url)
                response = redirect("hc-login-link-sent")
        if not User.objects.filter(email=email).exists():
            tz = form.cleaned_data["tz"]
            user = _make_user(email, tz)
            profile = Profile.objects.for_user(user)
            profile.send_instant_login_link()
    if "form" not in ctx:
{% load hc_extras %}
            <h1>Check Your Email!</h1>
                If a {% site_name %} account exists for this email address,
                you will receive a login link in your email shortly.
{% empty %}
<p class="text-success">Please check your email!</p>
{% endfor %}