Skip to content

request_password_reset: insufficiently escaped URL is incorrectly converted turned into a clickable link by GMail receiving plain text email #9111

Closed
@mathieulb

Description

@mathieulb

New Issue Checklist

Issue Description

If the username ends with punctuation (e.g. closing parenthesis), the password change URL is made clickable by GMail, except for that character, which causes a redirection to invalid_link.html.

Steps to reproduce

Create a username ending with a closing parenthesis. Call Parse.User.requestPasswordReset or the equivalent. Receive the plain text email. Email client detects a URL.

Actual Outcome

302 invalid_link.html

Expected Outcome

One of :
a) HTML message, so as to prevent link detection ;

b) a plain text message in which the link is somewhat more escaped than what is supposed to be required. Unfortunately I don't have a list of characters. The username is the only part of the link that has characters that might have to be escaped, so I say that you could escape all non \w characters in the username. E.g. user.username.replace(/\W/g, x=>"%"+x.charCodeAt(0).toString(16).padStart(2)) instead of encodeURIComponent(user.username) in sendPasswordResetEmail at lib/Controllers/UserController.js.

BTW there's another mail sender that doesn't get called, and whose buildEmailLink does not escape the username at all.

Environment

Server

  • Parse Server version: 6.5.5
  • Operating system: Heroku 22
  • Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Heroku

Database

  • System (MongoDB or Postgres): MongoDB
  • Database version: 3.6.12
  • Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Heroku ObjectRocket

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): ParseObjC (thru Swift)
  • SDK version: 2.7.0
  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): Android
  • SDK version: 4.2.1
  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): JavaScript (browser)
  • SDK version: 4.3.1

Logs

Metadata

Metadata

Assignees

No one assigned

    Labels

    state:releasedReleased as stable versionstate:released-alphaReleased as alpha versiontype:bugImpaired feature or lacking behavior that is likely assumed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions