From 19d48d987ca7752d04b6e86d8310d116a9f29714 Mon Sep 17 00:00:00 2001 From: Jaroslav Date: Thu, 20 Aug 2026 13:31:32 +0200 Subject: [PATCH] fix(security): stop rendering raw comment HTML unescaped in email notifications issue-updates.html rendered each new-comment value with {{ actor_comment|safe }}, which disables Django's autoescaping entirely. Since actor_comment is sourced from comment.comment_html - raw, unsanitized user input - a comment containing a payload like was written straight into the notification email and would execute in any email client that renders inline HTML/JS, as demonstrated with a live PoC in #9218 (CWE-79, reported 2026-06-05, still open). Neither this path nor the sibling "mention" path sanitizes comment content before this point - process_html_content()/process_mention() in email_notification_task.py only resolves @mention placeholders into plain text, it isn't a sanitizer, and comments (as opposed to mentions) don't even go through that step. Switch to the built-in `striptags` filter, one of the fix options already suggested in #9218. This strips all HTML (including any tag's attributes, so an onerror handler never reaches the output at all) and leaves the residual text through Django's normal autoescaping, which closes the hole without adding a new dependency. Verified against Django directly: the PoC payload from #9218 renders as executable HTML with |safe and as an empty string with |striptags. Comments will render as plain text in this email rather than keeping bold/ italic/link formatting - a deliberate, conservative tradeoff. A proper allowlist sanitizer (e.g. bleach) could preserve that formatting safely, but picking the right allowed-tags policy needs to match what the rich text editor actually emits, which is a decision for the maintainers; a hand-rolled allowlist isn't something to guess at in a security fix. --- apps/api/templates/emails/notifications/issue-updates.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/api/templates/emails/notifications/issue-updates.html b/apps/api/templates/emails/notifications/issue-updates.html index d82614ded61..3329e9c9f5e 100644 --- a/apps/api/templates/emails/notifications/issue-updates.html +++ b/apps/api/templates/emails/notifications/issue-updates.html @@ -210,7 +210,7 @@
-

{{ actor_comment|safe }}

+

{{ actor_comment|striptags }}