Merge pull request #7244 from pixelfed/fix/curated-register-details-xss

Escape message in curated register details email to fix reflected XSS

resources/views/emails/curated-register/request-details-from-user.blade.php

@@ -8,7 +8,7 @@ To help us process your registration application, we require more information.
 Our onboarding team have requested the following details:
 
 @component('mail::panel')
-<p style="white-space: pre-wrap;">{!! $activity->message !!}</p>
+<p style="white-space: pre-wrap;">{!! nl2br(e($activity->message)) !!}</p>
 @endcomponent
 <x-mail::button :url="$activity->emailReplyUrl()" color="success">
 <strong>Reply with your response</strong>

tests/Feature/CuratedRegisterEmailEscapeTest.php

@@ -2,6 +2,7 @@
 
 use App\Mail\CuratedRegisterNotifyAdmin;
 use App\Mail\CuratedRegisterNotifyAdminUserResponse;
+use App\Mail\CuratedRegisterRequestDetailsFromUser;
 use App\Models\CuratedRegister;
 use App\Models\CuratedRegisterActivity;
 use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
@@ -43,3 +44,27 @@ it('escapes user-provided content in the admin notification emails', function ()
     expect($responseHtml)->not->toContain('<script>alert(2)</script>');
     expect($responseHtml)->toContain('&lt;script&gt;');
 });
+
+/*
+| request-details-from-user is rendered as an HTTP response by the admin
+| previewDetailsMessageShow endpoint, which reflects a GET `message` param into
+| $activity->message. It must escape the message to prevent reflected XSS, the
+| same way its sibling admin templates do.
+*/
+it('escapes the message in the request-details-from-user mailable', function () {
+    $verify = new CuratedRegister;
+    $verify->username = 'attacker';
+    $verify->email = 'attacker@example.com';
+    $verify->save();
+
+    $activity = new CuratedRegisterActivity;
+    $activity->register_id = $verify->id;
+    $activity->message = '<img src=x onerror=alert(1)>';
+    $activity->save();
+
+    $detailsHtml = (new CuratedRegisterRequestDetailsFromUser($verify, $activity))->render();
+
+    // The raw <img> tag and its onerror handler must not survive as live HTML.
+    expect($detailsHtml)->not->toContain('<img src=x onerror=');
+    expect($detailsHtml)->toContain('&lt;img src=x onerror=alert(1)&gt;');
+});