We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Custom HTML email templates don't have a Freemarker output format set by default which results in the templates not auto-escaping templates by default
1.49.2
Steps to reproduce the behavior:
<html> <body> <p>Output format: ${.output_format}</p> <p>Auto-escaping: ${.auto_esc?c}</p> <p>Hi ${user.firstName}!</p> </body> </html>
<h1>John</h1>
<h1>John</h1> should be html escaped. However, no output format is set so an output format must be set manually. See Freemarker docs for details here.
Example email:
(Please complete the following information)
All issues filed in this repository must abide by the FusionAuth community guidelines.
The output format and auto-escaping values in the example are provided to demonstrate that no output format is being set.
The text was updated successfully, but these errors were encountered:
No branches or pull requests
XSS Vuln: HTML Email Templates Don't Auto-escape
Description
Custom HTML email templates don't have a Freemarker output format set by default which results in the templates not auto-escaping templates by default
Observed versions
1.49.2
Affects versions
1.49.2
Steps to reproduce
Steps to reproduce the behavior:
<h1>John</h1>
Expected behavior
<h1>John</h1>
should be html escaped. However, no output format is set so an output format must be set manually. See Freemarker docs for details here.Screenshots
Example email:
Platform
(Please complete the following information)
Community guidelines
All issues filed in this repository must abide by the FusionAuth community guidelines.
Additional context
The output format and auto-escaping values in the example are provided to demonstrate that no output format is being set.
The text was updated successfully, but these errors were encountered: