From: Andrew Donnellan <ajd@linux.ibm.com>
Date: Mon, 1 Jul 2019 05:28:03 +0000 (+1000)
Subject: templatetags: Do not mark output of msgid tag as safe
X-Git-Tag: v2.2.0-rc1~109
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=133a6c90e9826376be0f12f2ae6c2d7b076bdba0;p=thirdparty%2Fpatchwork.git

templatetags: Do not mark output of msgid tag as safe

The msgid template tag exists to remove angle brackets from either side of
the Message-ID header.

It also marks its output as safe, meaning it does not get autoescaped by
Django templating.

Its output is not safe. A maliciously crafted email can include HTML tags
inside the Message-ID header, and as long as the angle brackets are not at
the start and end of the header, we will quite happily render them.

Rather than using mark_safe(), use escape() to explicitly escape the
Message-ID.

Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
Signed-off-by: Daniel Axtens <dja@axtens.net>
---

diff --git a/patchwork/templatetags/patch.py b/patchwork/templatetags/patch.py
index ea5a71de..757f873b 100644
--- a/patchwork/templatetags/patch.py
+++ b/patchwork/templatetags/patch.py
@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from django import template
+from django.utils.html import escape
 from django.utils.safestring import mark_safe
 from django.template.defaultfilters import stringfilter
 
@@ -64,4 +65,4 @@ def patch_checks(patch):
 @register.filter
 @stringfilter
 def msgid(value):
-    return mark_safe(value.strip('<>'))
+    return escape(value.strip('<>'))