CVE-2022-4721 (published 2022-12-27T15:15Z)

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-75
cwe_name: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
description: The product does not adequately filter user-controlled input for special elements with control implications.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-12-21 15:27:33-05:00
msg: Disable automatic hyperlink in email template
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: notification.py
change_type: ModificationType.MODIFY
diff: @@ -73,7 +73,7 @@ class NotificationPlugin(SimplePlugin):
 
         # Send a mail notification
         body = self.app.templates.compile_template(
-            "access_token_added.html", **{"header_name": self.app.cfg.header_name, 'user': userobj, 'name': name}
+            "email_access_token_added.html", **{"header_name": self.app.cfg.header_name, 'user': userobj, 'name': name}
         )
         self.bus.publish('queue_mail', to=userobj.email, subject=_("A new access token has been created"), message=body)
 
@@ -118,7 +118,7 @@ class NotificationPlugin(SimplePlugin):
 
         # If the email attributes was changed, send a mail notification.
         body = self.app.templates.compile_template(
-            "password_changed.html", **{"header_name": self.app.cfg.header_name, 'user': userobj}
+            "email_password_changed.html", **{"header_name": self.app.cfg.header_name, 'user': userobj}
         )
         self.bus.publish('queue_mail', to=userobj.email, subject=_("Password changed"), message=body)
 

programming_language: Python
filename: test_notification.py
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ class NotificationJobTest(rdiffweb.test.WebCase):
         self.listener.queue_email.assert_called_once_with(
             to='test@test.com',
             subject='Notification',
-            message="<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      <li>testcases</li>\n    </ul>\n    <p>\n      If you don't want to be notify about this. You need to review your\n      user preferences.\n    </p>\n  </body>\n</html>",
+            message="<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      \n        <li>\n          <a>testcases</a>\n        </li>\n      \n    </ul>\n    <p>If you don't want to be notify about this. You need to review your user preferences.</p>\n  </body>\n</html>",
         )
 
     def test_notification_job_undefined_last_backup_date(self):
@@ -85,7 +85,7 @@ class NotificationJobTest(rdiffweb.test.WebCase):
         self.listener.queue_email.assert_called_once_with(
             to='test@test.com',
             subject='Notification',
-            message="<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      <li>broker-repo</li>\n    </ul>\n    <p>\n      If you don't want to be notify about this. You need to review your\n      user preferences.\n    </p>\n  </body>\n</html>",
+            message="<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      \n        <li>\n          <a>broker-repo</a>\n        </li>\n      \n    </ul>\n    <p>If you don't want to be notify about this. You need to review your user preferences.</p>\n  </body>\n</html>",
         )
 
     def test_notification_job_without_notification(self):
@@ -135,7 +135,7 @@ class NotificationPluginTest(rdiffweb.test.WebCase):
         self.listener.queue_email.assert_called_once_with(
             to='original_email@test.com',
             subject='Email address changed',
-            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the email address associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
+            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      <a>You recently changed the email address associated with your Rdiffweb account.</a>\n    </p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
         )
 
     def test_email_updated_with_same_value(self):
@@ -167,7 +167,7 @@ class NotificationPluginTest(rdiffweb.test.WebCase):
         self.listener.queue_email.assert_called_once_with(
             to='password_change@test.com',
             subject='Password changed',
-            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
+            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
         )
 
     def test_password_change_with_same_value(self):
@@ -186,5 +186,5 @@ class NotificationPluginTest(rdiffweb.test.WebCase):
         self.listener.queue_email.assert_called_once_with(
             to='password_change@test.com',
             subject='Password changed',
-            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
+            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
         )

programming_language: Python
filename: access_token_added.html
change_type: ModificationType.DELETE
diff: @@ -1,10 +0,0 @@
-<html>
-  <head></head>
-  <body>
-    {% trans username=user.username %}Hey {{ username }},{% endtrans %}
-    <p>{% trans %}A new access token, named "{{ name }}", has been created.{% endtrans %}</p>
-    <p>
-      {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}
-    </p>
-  </body>
-</html>

programming_language: unknown
filename: email_access_token_added.html
change_type: ModificationType.ADD
diff: @@ -0,0 +1,14 @@
+<html>
+  <head></head>
+  <body>
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
+    <p>
+      <a>{% trans %}A new access token, named "{{ name }}", has been created.{% endtrans %}</a>
+    </p>
+    <p>
+      {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}
+    </p>
+  </body>
+</html>

programming_language: HTML
filename: email_changed.html
change_type: ModificationType.MODIFY
diff: @@ -1,8 +1,12 @@
 <html>
   <head></head>
   <body>
-    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
-    <p>{% trans %}You recently changed the email address associated with your {{ header_name }} account.{% endtrans %}</p>
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
+    <p>
+      <a>{% trans %}You recently changed the email address associated with your {{ header_name }} account.{% endtrans %}</a>
+    </p>
     <p>
       {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}
     </p>

programming_language: HTML
filename: email_mfa.html
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,9 @@
 <html>
   <head></head>
   <body>
-    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
     <p>
       {% if user.mfa %}
         {% trans %}Your {{ header_name }} Account is now protected with Two-Factor Authentication. When you sign in on a new or untrusted device, you'll need your second factor to verify your identity.{% endtrans %}

programming_language: HTML
filename: email_notification.html
change_type: ModificationType.MODIFY
diff: @@ -1,18 +1,21 @@
 <html>
   <head></head>
   <body>
-    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
     <p>
       {% trans %}You are receiving this email to notify you about your backups. The
       following repositories are inactive for some time. We invite you to have a look
       at your last backup schedule.{% endtrans %}
     </p>
     <ul>
-      {% for r in repos %}<li>{{ r.display_name }}</li>{% endfor %}
+      {% for r in repos %}
+        <li>
+          <a>{{ r.display_name }}</a>
+        </li>
+      {% endfor %}
     </ul>
-    <p>
-      {% trans %}If you don't want to be notify about this. You need to review your
-      user preferences.{% endtrans %}
-    </p>
+    <p>{% trans %}If you don't want to be notify about this. You need to review your user preferences.{% endtrans %}</p>
   </body>
 </html>

programming_language: HTML
filename: email_password_changed.html
change_type: ModificationType.RENAME
diff: @@ -1,7 +1,9 @@
 <html>
   <head></head>
   <body>
-    {% trans username=user.username %}Hey {{ username }},{% endtrans %}
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
     <p>{% trans %}You recently changed the password associated with your {{ header_name }} account.{% endtrans %}</p>
     <p>
       {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}

programming_language: HTML
filename: email_verification_code.html
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,9 @@
 <html>
   <head></head>
   <body>
-    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
+    <p>
+      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
+    </p>
     <p>
       {% trans %}To help us make sure it's really you, here's the verification code you'll need to log in:{% endtrans %}
     </p>

programming_language: HTML