From c400741bae2477d8329a24b3498d059c28ced0d6 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 5 Jul 2019 11:30:28 +1000 Subject: [PATCH] templatetags: Do not mark output of msgid tag as safe The msgid template tag exists to remove angle brackets from either side of the Message-ID header. It also marks its output as safe, meaning it does not get autoescaped by Django templating. Its output is not safe. A maliciously crafted email can include HTML tags inside the Message-ID header, and as long as the angle brackets are not at the start and end of the header, we will quite happily render them. Rather than using mark_safe(), use escape() to explicitly escape the Message-ID. Signed-off-by: Andrew Donnellan (backported from 133a6c90e9826376be0f12f2ae6c2d7b076bdba0) Signed-off-by: Daniel Axtens --- patchwork/templatetags/patch.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/patchwork/templatetags/patch.py b/patchwork/templatetags/patch.py index 4350e092..577c7837 100644 --- a/patchwork/templatetags/patch.py +++ b/patchwork/templatetags/patch.py @@ -21,6 +21,7 @@ from __future__ import absolute_import from django import template +from django.utils.html import escape from django.utils.safestring import mark_safe from django.template.defaultfilters import stringfilter @@ -65,4 +66,4 @@ def state_class(state): @register.filter @stringfilter def msgid(value): - return mark_safe(value.strip('<>')) + return escape(value.strip('<>')) -- 2.47.3