fix: remote code execution in email endpoints (#25753)
Co-authored-by: crazywoola <100913391+crazywoola@users.noreply.github.com>
This commit is contained in:
parent
5a0bf8e028
commit
4f45978cd9
2 changed files with 55 additions and 1 deletions
|
|
@ -1,3 +1,4 @@
|
||||||
|
from enum import StrEnum
|
||||||
from typing import Literal
|
from typing import Literal
|
||||||
|
|
||||||
from pydantic import (
|
from pydantic import (
|
||||||
|
|
@ -711,11 +712,35 @@ class ToolConfig(BaseSettings):
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
class TemplateMode(StrEnum):
|
||||||
|
# unsafe mode allows flexible operations in templates, but may cause security vulnerabilities
|
||||||
|
UNSAFE = "unsafe"
|
||||||
|
|
||||||
|
# sandbox mode restricts some unsafe operations like accessing __class__.
|
||||||
|
# however, it is still not 100% safe, for example, cpu exploitation can happen.
|
||||||
|
SANDBOX = "sandbox"
|
||||||
|
|
||||||
|
# templating is disabled
|
||||||
|
DISABLED = "disabled"
|
||||||
|
|
||||||
|
|
||||||
class MailConfig(BaseSettings):
|
class MailConfig(BaseSettings):
|
||||||
"""
|
"""
|
||||||
Configuration for email services
|
Configuration for email services
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
MAIL_TEMPLATING_MODE: TemplateMode = Field(
|
||||||
|
description="Template mode for email services",
|
||||||
|
default=TemplateMode.SANDBOX,
|
||||||
|
)
|
||||||
|
|
||||||
|
MAIL_TEMPLATING_TIMEOUT: int = Field(
|
||||||
|
description="""
|
||||||
|
Timeout for email templating in seconds. Used to prevent infinite loops in malicious templates.
|
||||||
|
Only available in sandbox mode.""",
|
||||||
|
default=3,
|
||||||
|
)
|
||||||
|
|
||||||
MAIL_TYPE: str | None = Field(
|
MAIL_TYPE: str | None = Field(
|
||||||
description="Email service provider type ('smtp' or 'resend' or 'sendGrid), default to None.",
|
description="Email service provider type ('smtp' or 'resend' or 'sendGrid), default to None.",
|
||||||
default=None,
|
default=None,
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,46 @@
|
||||||
import logging
|
import logging
|
||||||
import time
|
import time
|
||||||
from collections.abc import Mapping
|
from collections.abc import Mapping
|
||||||
|
from typing import Any
|
||||||
|
|
||||||
import click
|
import click
|
||||||
from celery import shared_task
|
from celery import shared_task
|
||||||
from flask import render_template_string
|
from flask import render_template_string
|
||||||
|
from jinja2.runtime import Context
|
||||||
|
from jinja2.sandbox import ImmutableSandboxedEnvironment
|
||||||
|
|
||||||
|
from configs import dify_config
|
||||||
|
from configs.feature import TemplateMode
|
||||||
from extensions.ext_mail import mail
|
from extensions.ext_mail import mail
|
||||||
from libs.email_i18n import get_email_i18n_service
|
from libs.email_i18n import get_email_i18n_service
|
||||||
|
|
||||||
logger = logging.getLogger(__name__)
|
logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
|
class SandboxedEnvironment(ImmutableSandboxedEnvironment):
|
||||||
|
def __init__(self, timeout: int, *args: Any, **kwargs: Any):
|
||||||
|
self._timeout_time = time.time() + timeout
|
||||||
|
super().__init__(*args, **kwargs)
|
||||||
|
|
||||||
|
def call(self, context: Context, obj: Any, *args: Any, **kwargs: Any) -> Any:
|
||||||
|
if time.time() > self._timeout_time:
|
||||||
|
raise TimeoutError("Template rendering timeout")
|
||||||
|
return super().call(context, obj, *args, **kwargs)
|
||||||
|
|
||||||
|
|
||||||
|
def _render_template_with_strategy(body: str, substitutions: Mapping[str, str]) -> str:
|
||||||
|
mode = dify_config.MAIL_TEMPLATING_MODE
|
||||||
|
timeout = dify_config.MAIL_TEMPLATING_TIMEOUT
|
||||||
|
if mode == TemplateMode.UNSAFE:
|
||||||
|
return render_template_string(body, **substitutions)
|
||||||
|
if mode == TemplateMode.SANDBOX:
|
||||||
|
tmpl = SandboxedEnvironment(timeout=timeout).from_string(body)
|
||||||
|
return tmpl.render(substitutions)
|
||||||
|
if mode == TemplateMode.DISABLED:
|
||||||
|
return body
|
||||||
|
raise ValueError(f"Unsupported mail templating mode: {mode}")
|
||||||
|
|
||||||
|
|
||||||
@shared_task(queue="mail")
|
@shared_task(queue="mail")
|
||||||
def send_inner_email_task(to: list[str], subject: str, body: str, substitutions: Mapping[str, str]):
|
def send_inner_email_task(to: list[str], subject: str, body: str, substitutions: Mapping[str, str]):
|
||||||
if not mail.is_inited():
|
if not mail.is_inited():
|
||||||
|
|
@ -21,7 +50,7 @@ def send_inner_email_task(to: list[str], subject: str, body: str, substitutions:
|
||||||
start_at = time.perf_counter()
|
start_at = time.perf_counter()
|
||||||
|
|
||||||
try:
|
try:
|
||||||
html_content = render_template_string(body, **substitutions)
|
html_content = _render_template_with_strategy(body, substitutions)
|
||||||
|
|
||||||
email_service = get_email_i18n_service()
|
email_service = get_email_i18n_service()
|
||||||
email_service.send_raw_email(to=to, subject=subject, html_content=html_content)
|
email_service.send_raw_email(to=to, subject=subject, html_content=html_content)
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue