Description
New Issue Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Issue Description
If the username ends with punctuation (e.g. closing parenthesis), the password change URL is made clickable by GMail, except for that character, which causes a redirection to invalid_link.html
.
Steps to reproduce
Create a username ending with a closing parenthesis. Call Parse.User.requestPasswordReset
or the equivalent. Receive the plain text email. Email client detects a URL.
Actual Outcome
302 invalid_link.html
Expected Outcome
One of :
a) HTML message, so as to prevent link detection ;
b) a plain text message in which the link is somewhat more escaped than what is supposed to be required. Unfortunately I don't have a list of characters. The username is the only part of the link that has characters that might have to be escaped, so I say that you could escape all non \w characters in the username. E.g. user.username.replace(/\W/g, x=>"%"+x.charCodeAt(0).toString(16).padStart(2))
instead of encodeURIComponent(user.username)
in sendPasswordResetEmail at lib/Controllers/UserController.js.
BTW there's another mail sender that doesn't get called, and whose buildEmailLink
does not escape the username at all.
Environment
Server
- Parse Server version: 6.5.5
- Operating system: Heroku 22
- Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Heroku
Database
- System (MongoDB or Postgres): MongoDB
- Database version: 3.6.12
- Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Heroku ObjectRocket
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc): ParseObjC (thru Swift)
- SDK version: 2.7.0
- SDK (iOS, Android, JavaScript, PHP, Unity, etc): Android
- SDK version: 4.2.1
- SDK (iOS, Android, JavaScript, PHP, Unity, etc): JavaScript (browser)
- SDK version: 4.3.1