Mail Check - Dangling Markup Injection in Confirmation Emails - Githubissues

tridentli / trident

Trident is a trusted and secure communication platform for enabling better communication between groups of trusted parties

https://trident.li

Apache License 2.0

20 stars 9 forks source link

Mail Check - Dangling Markup Injection in Confirmation Emails #95

Open massar opened 7 years ago

massar commented 7 years ago

For the emails we sent out, make sure there is no (valid) HTML in them.

While we do not set the content to HTML, likely quite a few mail clients will just render it as HTML.

Thus at minimum we should never allow '<' and '>' in any fields that we render as email, so that no HTML tags can be formed.

See amongst others:

http://lcamtuf.coredump.cx/postxss/ https://thehackerblog.com/keeping-positive-obtaining-arbitrary-wildcard-ssl-certificates-from-comodo-via-dangling-markup-injection/index.html