Merge commit from fork

[security] Always sanitize RichText output for safe-HTML output type

Author: mauritsvanrees

news/+b4bb1c80.bugfix.rst

@@ -0,0 +1,3 @@
+Security: Always sanitize RichText output for safe-HTML output type.
+See https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5
+@gyst

plone/app/textfield/tests.py

@@ -47,6 +47,39 @@ def testTransformNone(self):
         self.assertEqual(None, value.raw)
         self.assertEqual(None, value.output)
 
+    def assertXSSPayloadIsSanitized(self, value):
+        payload = '<img src=x onerror="alert(1)">'
+        output = value.output_relative_to(self.portal)
+
+        self.assertNotIn(payload, output)
+        self.assertNotIn("onerror", output.lower())
+
+    def testOutputSanitizesLazyRichTextValueConstructor(self):
+        from plone.app.textfield.value import RichTextValue
+
+        payload = '<img src=x onerror="alert(1)">'
+        value = RichTextValue(payload)
+
+        self.assertXSSPayloadIsSanitized(value)
+
+    def testOutputSanitizesSpoofedSafeHtmlMimeType(self):
+        from plone.app.textfield.value import RichTextValue
+
+        # A value whose input mimeType claims to already be the safe-HTML
+        # output type must NOT be trusted as pre-sanitized: output must still
+        # run safe_html. This is the same bypass an untrusted REST client
+        # reaches by sending content-type: text/x-html-safe (covered by a
+        # deserializer test in plone.restapi); here we exercise the value
+        # layer directly to avoid a test-time dependency on plone.restapi.
+        payload = '<img src=x onerror="alert(1)">'
+        value = RichTextValue(
+            payload,
+            mimeType="text/x-html-safe",
+            outputMimeType="text/x-html-safe",
+        )
+
+        self.assertXSSPayloadIsSanitized(value)
+
     def testTransformStructured(self):
         from plone.app.textfield import RichText
         from zope.interface import Interface

plone/app/textfield/value.py

@@ -9,6 +9,9 @@
 
 LOG = logging.getLogger("plone.app.textfield")
 
+HTML_MIME_TYPE = "text/html"
+SAFE_HTML_MIME_TYPE = "text/x-html-safe"
+
 
 class RawValueHolder(Persistent):
     """Place the raw value in a separate persistent object so that it does not
@@ -84,6 +87,14 @@ def mimeType(self):
     def outputMimeType(self):
         return self._outputMimeType
 
+    def _clone_for_transform(self, mimeType, outputMimeType):
+        clone = self.__class__.__new__(self.__class__)
+        clone._raw_holder = self._raw_holder
+        clone._mimeType = mimeType
+        clone._outputMimeType = outputMimeType
+        clone._encoding = self.encoding
+        return clone
+
     @property
     def output(self):
         site = getSite()
@@ -93,7 +104,7 @@ def output_relative_to(self, context):
         """Transforms the raw value to the output mimetype, within a specified context.
 
         If the value's mimetype is already the same as the output mimetype,
-        no transformation is performed.
+        no transformation is performed unless safe HTML output is requested.
 
         The context parameter is relevant when the transformation is
         context-dependent. For example, Plone's resolveuid-and-caption
@@ -103,17 +114,34 @@ def output_relative_to(self, context):
         If a transformer cannot be found for the specified context, a
         transformer with the site as a context is used instead.
         """
-        if self.mimeType == self.outputMimeType:
+        if self.raw is None:
+            return None
+
+        mimeType = self.mimeType or HTML_MIME_TYPE
+        outputMimeType = self.outputMimeType or SAFE_HTML_MIME_TYPE
+
+        if mimeType == outputMimeType and outputMimeType != SAFE_HTML_MIME_TYPE:
             return self.raw
 
+        if mimeType == SAFE_HTML_MIME_TYPE and outputMimeType == SAFE_HTML_MIME_TYPE:
+            # Treat stored safe HTML as HTML when rendering to the safe HTML
+            # output type.  The safe_html transform is idempotent for already
+            # safe markup, and this avoids trusting attacker-controlled input
+            # that merely claims to be text/x-html-safe.
+            mimeType = HTML_MIME_TYPE
+
         transformer = ITransformer(context, None)
         if transformer is None:
             site = getSite()
             transformer = ITransformer(site, None)
             if transformer is None:
                 return None
 
-        return transformer(self, self.outputMimeType)
+        value = self
+        if mimeType != self.mimeType or outputMimeType != self.outputMimeType:
+            value = self._clone_for_transform(mimeType, outputMimeType)
+
+        return transformer(value, outputMimeType)
 
     def __repr__(self):
         return (