Merge pull request #9858 from colinux/fix-invite-html-injection

Tech: sanitize les messages utilisateurs dans les emails

app/views/invite_mailer/invite_guest.html.haml

@@ -10,8 +10,7 @@
 
 - if @invite.message.present?
   %blockquote
-    %p
-      = @invite.message
+    = simple_format(@invite.message)
 
 %p
   Cette plateforme permet à ses utilisateurs d’établir des dossiers 100 % en ligne et de dialoguer avec plusieurs interlocuteurs privilégiés avant d’instruire un dépot.

app/views/invite_mailer/invite_user.html.haml

@@ -8,8 +8,7 @@
 
 - if @invite.message.present?
   %blockquote
-    %p
-      = @invite.message
+    = simple_format(@invite.message)
 
 %p
   Pour le consulter, merci de suivre ce lien :

app/views/layouts/mailers/layout.html.erb

@@ -9,7 +9,7 @@
       <!--<![endif]-->
       <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
-      <style type="text/css">  #outlook a { padding: 0; }  .ReadMsgBody { width: 100%; }  .ExternalClass { width: 100%; }  .ExternalClass * { line-height:100%; }  body { margin: 0; padding: 0; -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; }  table, td { border-collapse:collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; }  img { border: 0; height: auto; line-height: 100%; outline: none; text-decoration: none; -ms-interpolation-mode: bicubic; }  p { display: block; margin: 13px 0; } blockquote { margin: 0; } blockquote p { padding: 15px; background: #eee; border-radius: 5px; } blockquote p::before { content: '\201C'; } blockquote p::after { content: '\201D'; }</style>
+      <style type="text/css">  #outlook a { padding: 0; }  .ReadMsgBody { width: 100%; }  .ExternalClass { width: 100%; }  .ExternalClass * { line-height:100%; }  body { margin: 0; padding: 0; -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; }  table, td { border-collapse:collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; }  img { border: 0; height: auto; line-height: 100%; outline: none; text-decoration: none; -ms-interpolation-mode: bicubic; }  p { display: block; margin: 13px 0; } blockquote { margin: 0; background: #eee; } blockquote p { padding: 10px; border-radius: 5px; }</style>
       <!--[if !mso]>
         <!-->
           <style type="text/css">  @media only screen and (max-width:480px) {    @-ms-viewport { width:320px; }    @viewport { width:320px; }  }</style>

spec/factories/invite.rb

@@ -3,6 +3,7 @@ FactoryBot.define do
     email { 'plop@octo.com' }
     user { nil }
     association :dossier
+    message { "un message d'invitation" }
 
     after(:build) do |invite, _evaluator|
       if invite.user.present?

spec/mailers/invite_mailer_spec.rb

@@ -44,6 +44,13 @@ RSpec.describe InviteMailer, type: :mailer do
         expect { invite }.to have_enqueued_job.on_queue(Rails.application.config.action_mailer.deliver_later_queue_name)
       end
     end
+
+    context 'message contains malicious link' do
+      let(:invite) { create(:invite, user: create(:user), message: "Coucou\n<a href=\"https://malicious.site\">trusted anchor</a>") }
+      it 'sanitize message' do
+        expect(subject.body.decoded).to match(%r{<p>Coucou\s+<br />trusted anchor</p>})
+      end
+    end
   end
 
   describe '.invite_guest' do
@@ -88,5 +95,12 @@ RSpec.describe InviteMailer, type: :mailer do
         expect { invite }.to have_enqueued_job.on_queue(Rails.application.config.action_mailer.deliver_later_queue_name)
       end
     end
+
+    context 'message contains malicious link' do
+      let(:invite) { create(:invite, user: create(:user), message: "Coucou\n<a href=\"https://malicious.site\">trusted anchor</a>") }
+      it 'sanitize message' do
+        expect(subject.body.decoded).to match(%r{<p>Coucou\s+<br />trusted anchor</p>})
+      end
+    end
   end
 end