Skip to content

Commit 8d410b7

Browse files
FelixSchwarzFelixSchwarz
committed
escaped HTML entities like > were unescaped in the final mjml output
1 parent 136697f commit 8d410b7

6 files changed

+147
-4
lines changed

‎CHANGELOG.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11

2+
0.11.0 (2024-02-xx)
3+
-------------------
4+
5+
- security fix: escaped HTML entities like `>` were unescaped in the final mjml output, leading to potential injection of untrusted user data (reported by @sh-at-cs)
6+
7+
28
0.10.0 (2023-11-17)
39
------------------
410

‎mjml/elements/head/mj_style.py

+7-2
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,15 @@ class MjStyle(HeadComponent):
1010
@classmethod
1111
def default_attrs(cls):
1212
return {
13-
'inline' : '',
13+
'inline': '',
1414
}
1515

1616
def handler(self):
1717
add = self.context['add']
1818
inline_attr = 'inlineStyle' if (self.get_attr('inline') == 'inline') else 'style'
19-
add(inline_attr, self.getContent())
19+
html_str = self.getContent()
20+
# CSS can contain child selectors (e.g. "h1 > p") beautifulsoup only
21+
# returns escaped entities. To make these selectors work, we need to
22+
# unescape these.
23+
css_str = html_str.replace('>', '>')
24+
add(inline_attr, css_str)

‎mjml/mjml2html.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ def parse(_mjml, parentMjClass='', *, template_dir):
116116
classes = ignore_empty(attributes.get('mj-class', '').split(' '))
117117

118118
# upstream parses text contents (+ comments) in mjml-parser-xml/index.js
119-
content = _mjml.decode_contents(formatter=None)
119+
content = _mjml.decode_contents()
120120

121121
attributesClasses = {}
122122
for css_class in classes:
@@ -213,7 +213,7 @@ def _head_data_add(attr, *params):
213213
for element in contentSoup.select(selector):
214214
element[attrName] = value or ''
215215

216-
content = contentSoup.decode_contents(formatter=None)
216+
content = contentSoup.decode_contents()
217217

218218
content = skeleton(
219219
content=content,

‎tests/testdata/mj-text-escaped-html-expected.html

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
<!doctype html>
2+
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
3+
4+
<head>
5+
<title>
6+
</title>
7+
<!--[if !mso]><!-->
8+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
9+
<!--<![endif]-->
10+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
11+
<meta name="viewport" content="width=device-width, initial-scale=1">
12+
<style type="text/css">
13+
#outlook a {
14+
padding: 0;
15+
}
16+
17+
body {
18+
margin: 0;
19+
padding: 0;
20+
-webkit-text-size-adjust: 100%;
21+
-ms-text-size-adjust: 100%;
22+
}
23+
24+
table,
25+
td {
26+
border-collapse: collapse;
27+
mso-table-lspace: 0pt;
28+
mso-table-rspace: 0pt;
29+
}
30+
31+
img {
32+
border: 0;
33+
height: auto;
34+
line-height: 100%;
35+
outline: none;
36+
text-decoration: none;
37+
-ms-interpolation-mode: bicubic;
38+
}
39+
40+
p {
41+
display: block;
42+
margin: 13px 0;
43+
}
44+
45+
</style>
46+
<!--[if mso]>
47+
<noscript>
48+
<xml>
49+
<o:OfficeDocumentSettings>
50+
<o:AllowPNG/>
51+
<o:PixelsPerInch>96</o:PixelsPerInch>
52+
</o:OfficeDocumentSettings>
53+
</xml>
54+
</noscript>
55+
<![endif]-->
56+
<!--[if lte mso 11]>
57+
<style type="text/css">
58+
.mj-outlook-group-fix { width:100% !important; }
59+
</style>
60+
<![endif]-->
61+
<!--[if !mso]><!-->
62+
<link href="https://fonts.googleapis.com/css?family=Ubuntu:300,400,500,700" rel="stylesheet" type="text/css">
63+
<style type="text/css">
64+
@import url(https://fonts.googleapis.com/css?family=Ubuntu:300,400,500,700);
65+
66+
</style>
67+
<!--<![endif]-->
68+
<style type="text/css">
69+
@media only screen and (min-width:480px) {
70+
.mj-column-per-100 {
71+
width: 100% !important;
72+
max-width: 100%;
73+
}
74+
}
75+
76+
</style>
77+
<style media="screen and (min-width:480px)">
78+
.moz-text-html .mj-column-per-100 {
79+
width: 100% !important;
80+
max-width: 100%;
81+
}
82+
83+
</style>
84+
<style type="text/css">
85+
</style>
86+
<style type="text/css">
87+
</style>
88+
</head>
89+
90+
<body style="word-spacing:normal;">
91+
<div style="">
92+
<!--[if mso | IE]><table align="center" border="0" cellpadding="0" cellspacing="0" class="" role="presentation" style="width:600px;" width="600" ><tr><td style="line-height:0px;font-size:0px;mso-line-height-rule:exactly;"><![endif]-->
93+
<div style="margin:0px auto;max-width:600px;">
94+
<table align="center" border="0" cellpadding="0" cellspacing="0" role="presentation" style="width:100%;">
95+
<tbody>
96+
<tr>
97+
<td style="direction:ltr;font-size:0px;padding:20px 0;text-align:center;">
98+
<!--[if mso | IE]><table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td class="" style="vertical-align:top;width:600px;" ><![endif]-->
99+
<div class="mj-column-per-100 mj-outlook-group-fix" style="font-size:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;width:100%;">
100+
<table border="0" cellpadding="0" cellspacing="0" role="presentation" style="vertical-align:top;" width="100%">
101+
<tbody>
102+
<tr>
103+
<td align="left" style="font-size:0px;padding:10px 25px;word-break:break-word;">
104+
<div style="font-family:Ubuntu, Helvetica, Arial, sans-serif;font-size:13px;line-height:1;text-align:left;color:#000000;">Pretty unsafe: &lt;script&gt;</div>
105+
</td>
106+
</tr>
107+
</tbody>
108+
</table>
109+
</div>
110+
<!--[if mso | IE]></td></tr></table><![endif]-->
111+
</td>
112+
</tr>
113+
</tbody>
114+
</table>
115+
</div>
116+
<!--[if mso | IE]></td></tr></table><![endif]-->
117+
</div>
118+
</body>
119+
120+
</html>

‎tests/testdata/mj-text-escaped-html.mjml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<mjml>
2+
<mj-body>
3+
<mj-section>
4+
<mj-column>
5+
<mj-text>
6+
Pretty unsafe: &lt;script&gt;
7+
</mj-text>
8+
</mj-column>
9+
</mj-section>
10+
</mj-body>
11+
</mjml>

‎tests/upstream_alignment_test.py

+1
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848
'mj-raw-head-with-tags',
4949
'mj-social',
5050
'mj-spacer',
51+
'mj-text-escaped-html', # this test is security-critical
5152
'mj-wrapper',
5253
)
5354

0 commit comments

Comments
 (0)