CVE-2022-23549 (published 2023-01-05T19:15Z)

Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` branches, users can create posts with raw body longer than the `max_length` site setting by including html comments that are not counted toward the character limit. This issue is patched in versions 2.8.14 and 2.9.0.beta16. There are no known workarounds.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse
commit_details: repo_url: https://github.com/discourse/discourse
author: Alan Guo Xiang Tan
author_date: 2023-01-05 06:08:43+08:00
msg: SECURITY: Check the length of raw post body (#19733)

Co-authored-by: Jarek Radosz <jradosz@gmail.com>
repository: repo_url: https://github.com/discourse/discourse
repo_name: discourse/discourse
description: A platform for community discussion. Free, open, simple.
repo_language: Ruby
owner: discourse
file_changes: filename: stripped_length_validator.rb
change_type: ModificationType.MODIFY
diff: @@ -2,12 +2,16 @@
 
 class StrippedLengthValidator < ActiveModel::EachValidator
   def self.validate(record, attribute, value, range)
-    if !value.nil?
-      value = get_sanitized_value(value)
-      record.errors.add attribute, (I18n.t('errors.messages.too_short', count: range.begin)) if value.length < range.begin
-      record.errors.add attribute, (I18n.t('errors.messages.too_long_validation', max: range.end, length: value.length)) if value.length > range.end
+    if value.nil?
+      record.errors.add attribute, I18n.t('errors.messages.blank')
+    elsif value.length > range.end
+      record.errors.add attribute, I18n.t('errors.messages.too_long_validation', max: range.end, length: value.length)
     else
-      record.errors.add attribute, (I18n.t('errors.messages.blank'))
+      value = get_sanitized_value(value)
+
+      if value.length < range.begin
+        record.errors.add attribute, I18n.t('errors.messages.too_short', count: range.begin)
+      end
     end
   end
 

programming_language: Ruby
filename: posts_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -1050,6 +1050,20 @@ RSpec.describe PostsController do
           parsed = response.parsed_body
           expect(parsed["action"]).not_to eq("enqueued")
         end
+
+        it "doesn't enqueue replies when the post is too long (including a html comment)" do
+          SiteSetting.max_post_length = 10
+          raw = "A post <!-- " + ("a" * 3000) + "-->"
+
+          post "/posts.json", params: {
+            raw: raw,
+            title: "this is the test title for the topic"
+          }
+
+          expect(response).not_to be_successful
+          parsed = response.parsed_body
+          expect(parsed["action"]).not_to eq("enqueued")
+        end
       end
 
       it 'silences correctly based on auto_silence_first_post_regex' do

programming_language: Ruby