From cc2b7c2798e76f07bbe7c0e3d44ed7777e837b7f Mon Sep 17 00:00:00 2001
From: Andrew Ruthven <andrew@etc.gen.nz>
Date: Wed, 16 Apr 2025 00:07:03 +1200
Subject: Fix four security issues in RT.

* RT is vulnerable to Cross Site Scripting via injection of malicious
  parameters in a search URL. This vulnerability is assigned CVE-2025-30087.
* RT uses the default OpenSSL cipher, 3DES (des3), for encrypting SMIME email.
  This is an outdated cipher algorithm, so the default is changed to
  aes-128-cbc. In addition, we have made this option configurable so you can
  pick an alternate cipher now or in the future, or revert to des3 if needed
  for compatibility. This vulnerability is assigned CVE-2025-2545.
* RT is vulnerable to Cross Site Scripting via JavaScript injection in an
  Asset name. This vulnerability is assigned CVE-2025-31501.
* RT is vulnerable to Cross Site Scripting via JavaScript injection in an RT
  permalink. This vulnerability is assigned CVE-2025-31500.

Patch-Name: upstream_5.0.3_cve:_patchset_2025-04-08.diff
Author: Best Practical <support@bestpractical.com>
Forwarded: not-needed
Applied: 5.0.8
---
 etc/RT_Config.pm                             |  24 +++
 lib/RT/Crypt/SMIME.pm                        |   2 +-
 lib/RT/Interface/Web.pm                      |   9 +-
 lib/RT/Interface/Web/Scrubber/Restrictive.pm | 148 +++++++++++++++++++
 share/html/Asset/Elements/TSVExport          |   2 +-
 share/html/Elements/CollectionList           |   4 +-
 share/html/Elements/ScrubHTML                |   2 +-
 share/html/Elements/TSVExport                |   2 +-
 share/html/Search/Build.html                 |   2 +-
 share/html/Search/Edit.html                  |   2 +-
 share/html/Ticket/Graphs/dhandler            |   4 +
 share/static/js/util.js                      |  13 +-
 12 files changed, 203 insertions(+), 11 deletions(-)
 create mode 100644 lib/RT/Interface/Web/Scrubber/Restrictive.pm

diff --git a/etc/RT_Config.pm b/etc/RT_Config.pm
index 4da54597..891df772 100644
--- a/etc/RT_Config.pm
+++ b/etc/RT_Config.pm
@@ -1119,6 +1119,26 @@ higher numbers denoting greater effort.
 
 Set($BcryptCost, 12);
 
+=item C<@RestrictLinkDomains>
+
+This sets a list of external domains that RT is allowed to link to. If this
+setting is empty, no external domains are allowed.
+
+Currently, this restriction only applies to links in Format parameter for
+search results. All external links whose domains are not in the list will
+be removed.
+
+E.g.
+
+    Set(@RestrictLinkDomains, ("example.com", "*.trusted.com"));
+
+    example.com    # Allow links to "example.com"
+    *.trusted.com  # Allow links to any one-level subdomain of "trusted.com"
+
+=cut
+
+Set(@RestrictLinkDomains, ());
+
 =back
 
 =head2 Internationalization
@@ -3978,6 +3998,9 @@ Set C<CheckRevocationDownloadTimeout> to the timeout in seconds for
 downloading a CRL or an issuer certificate (the latter is used when
 checking against OCSP).  The default timeout is 30 seconds.
 
+Set C<Cipher> to the encryption algorithm to use. By default, it's
+C<aes-128-cbc>.
+
 See L<RT::Crypt::SMIME> for details.
 
 =back
@@ -3995,6 +4018,7 @@ Set( %SMIME,
     CheckCRL => 0,
     CheckOCSP => 0,
     CheckRevocationDownloadTimeout => 30,
+    Cipher => 'aes-128-cbc',
 );
 
 =head3 GnuPG configuration
diff --git a/lib/RT/Crypt/SMIME.pm b/lib/RT/Crypt/SMIME.pm
index 3b20cff3..cce88d06 100644
--- a/lib/RT/Crypt/SMIME.pm
+++ b/lib/RT/Crypt/SMIME.pm
@@ -425,7 +425,7 @@ sub _SignEncrypt {
             $key = $key_file;
         }
         push @commands, [
-            $self->OpenSSLPath, qw(smime -encrypt -des3),
+            $self->OpenSSLPath, qw(smime -encrypt), '-' . ( $opts->{Cipher} || 'aes-128-cbc' ),
             map { $_->filename } @keys
         ];
     }
diff --git a/lib/RT/Interface/Web.pm b/lib/RT/Interface/Web.pm
index 9133deec..7a03f79f 100644
--- a/lib/RT/Interface/Web.pm
+++ b/lib/RT/Interface/Web.pm
@@ -74,6 +74,7 @@ use URI qw();
 use RT::Interface::Web::Menu;
 use RT::Interface::Web::Session;
 use RT::Interface::Web::Scrubber;
+use RT::Interface::Web::Scrubber::Restrictive;
 use Digest::MD5 ();
 use List::MoreUtils qw();
 use JSON qw();
@@ -4699,7 +4700,7 @@ sub _parse_saved_search {
     return ( _load_container_object( $obj_type, $obj_id ), $search_id );
 }
 
-=head2 ScrubHTML content
+=head2 ScrubHTML Content => CONTENT, Restrictive => 1|0
 
 Removes unsafe and undesired HTML from the passed content
 
@@ -4712,14 +4713,18 @@ Removes unsafe and undesired HTML from the passed content
 our $ReloadScrubber;
 
 sub ScrubHTML {
+    my %args = @_ % 2 ? ( Content => @_ ) : @_;
+
     state $scrubber = RT::Interface::Web::Scrubber->new;
+    state $restrictive_scrubber = RT::Interface::Web::Scrubber::Restrictive->new;
 
     if ( $HTML::Mason::Commands::ReloadScrubber ) {
         $scrubber = RT::Interface::Web::Scrubber->new;
+        $restrictive_scrubber = RT::Interface::Web::Scrubber::Restrictive->new;
         $HTML::Mason::Commands::ReloadScrubber = 0;
     }
 
-    return $scrubber->scrub(@_);
+    return ( $args{Restrictive} ? $restrictive_scrubber : $scrubber )->scrub( $args{Content} );
 }
 
 =head2 JSON
diff --git a/lib/RT/Interface/Web/Scrubber/Restrictive.pm b/lib/RT/Interface/Web/Scrubber/Restrictive.pm
new file mode 100644
index 00000000..aecfca88
--- /dev/null
+++ b/lib/RT/Interface/Web/Scrubber/Restrictive.pm
@@ -0,0 +1,148 @@
+# BEGIN BPS TAGGED BLOCK {{{
+#
+# COPYRIGHT:
+#
+# This software is Copyright (c) 1996-2024 Best Practical Solutions, LLC
+#                                          <sales@bestpractical.com>
+#
+# (Except where explicitly superseded by other copyright notices)
+#
+#
+# LICENSE:
+#
+# This work is made available to you under the terms of Version 2 of
+# the GNU General Public License. A copy of that license should have
+# been provided with this software, but in any event can be snarfed
+# from www.gnu.org.
+#
+# This work is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301 or visit their web page on the internet at
+# http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
+#
+#
+# CONTRIBUTION SUBMISSION POLICY:
+#
+# (The following paragraph is not intended to limit the rights granted
+# to you to modify and distribute this software under the terms of
+# the GNU General Public License and is only of importance to you if
+# you choose to contribute your changes and enhancements to the
+# community by submitting them to Best Practical Solutions, LLC.)
+#
+# By intentionally submitting any modifications, corrections or
+# derivatives to this work, or any other work intended for use with
+# Request Tracker, to Best Practical Solutions, LLC, you confirm that
+# you are the copyright holder for those contributions and you grant
+# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
+# royalty-free, perpetual, license to use, copy, create derivative
+# works based on those contributions, and sublicense and distribute
+# those contributions and any derivatives thereof.
+#
+# END BPS TAGGED BLOCK }}}
+
+package RT::Interface::Web::Scrubber::Restrictive;
+use strict;
+use warnings;
+use 5.010;
+use base qw/RT::Interface::Web::Scrubber/;
+
+
+=head1 NAME
+
+RT::Interface::Web::Scrubber::Restrictive
+
+=head1 DESCRIPTION
+
+This is a subclass of L<RT::Interface::Web::Scrubber>. It's stricter than
+L<RT::Interface::Web::Scrubber> with the following additional restrictions:
+
+=over 4
+
+=item Links
+
+External domains not defined in L<RT_Config/RestrictLinkDomains> will be removed.
+
+=back
+
+=head1 VARIABLES
+
+These variables can be altered by creating a C<Restrictive_Local.pm>
+file, containing something of the form:
+
+    package RT::Interface::Web::Scrubber::Restrictive;
+
+    # Deny the "alt" attribute of images
+    $RULES{'img'} = { alt => 0 };
+
+=over
+
+=item C<%RULES>
+
+Passed to L<HTML::Scrubber/rules>.
+
+=back
+
+=cut
+
+our %RULES = (
+    a => {
+        $RT::Interface::Web::Scrubber::RULES{a} ? %{ $RT::Interface::Web::Scrubber::RULES{a} } : (),
+        href => sub {
+            my ( $self, $tag, $attr, $href ) = @_;
+            return $href unless $href;
+
+            # Allow internal RT macros like __WebPath__, etc.
+            return $href if $href =~ qr{^(?:/|__Web(?:Path|HomePath|BaseURL|URL)__)}i;
+
+            my $uri = URI->new($href);
+            unless ( $uri->can("host") && $uri->host ) {
+                RT->Logger->warn("Unknown link: $href");
+                return '';
+            }
+
+            my $rt_host = RT::Interface::Web::_NormalizeHost( RT->Config->Get('WebBaseURL') )->host;
+            my $host    = lc $uri->host;
+            for my $allowed_domain ( $rt_host, @{ RT->Config->Get('RestrictLinkDomains') || [] } ) {
+                if ( $allowed_domain =~ /\*/ ) {
+
+                    # Turn a literal * into a domain component or partial component match.
+                    my $regex = join "[a-zA-Z0-9\-]*", map { quotemeta($_) }
+                        split /\*/, $allowed_domain;
+                    return $href if $host =~ /^$regex$/i;
+                }
+                else {
+                    return $href if $host eq lc($allowed_domain);
+                }
+            }
+
+            RT->Logger->warning("Blocked link: $href");
+            return '';
+        },
+    },
+);
+
+=head1 METHODS
+
+=head2 new
+
+Returns a new L<RT::Interface::Web::Scrubber::Restrictive> object.
+
+=cut
+
+sub new {
+    my $class = shift;
+    my $self = $class->SUPER::new(@_);
+
+    $self->rules(%RULES);
+    return $self;
+}
+
+RT::Base->_ImportOverlays();
+
+1;
diff --git a/share/html/Asset/Elements/TSVExport b/share/html/Asset/Elements/TSVExport
index 660a19eb..646adb1a 100644
--- a/share/html/Asset/Elements/TSVExport
+++ b/share/html/Asset/Elements/TSVExport
@@ -58,7 +58,7 @@ require HTML::Entities;
 
 $r->content_type('application/vnd.ms-excel');
 
-my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format);
+my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 
diff --git a/share/html/Elements/CollectionList b/share/html/Elements/CollectionList
index 9e84f4a4..4393011b 100644
--- a/share/html/Elements/CollectionList
+++ b/share/html/Elements/CollectionList
@@ -100,8 +100,8 @@ $Collection->GotoPage( $Page - 1 ); # SB uses page 0 as the first page
 $DisplayFormat ||= $Format;
 
 # Scrub the html of the format string to remove any potential nasties.
-$Format = $m->comp('/Elements/ScrubHTML', Content => $Format);
-$DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $DisplayFormat);
+$Format = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
+$DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $DisplayFormat, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 
diff --git a/share/html/Elements/ScrubHTML b/share/html/Elements/ScrubHTML
index 2a1c7f60..84636070 100644
--- a/share/html/Elements/ScrubHTML
+++ b/share/html/Elements/ScrubHTML
@@ -46,7 +46,7 @@
 %#
 %# END BPS TAGGED BLOCK }}}
 <%init>
-return ScrubHTML($Content);
+return ScrubHTML($Content, %ARGS);
 </%init>
 <%args>
 $Content => undef
diff --git a/share/html/Elements/TSVExport b/share/html/Elements/TSVExport
index 5f9427f9..5a13fecb 100644
--- a/share/html/Elements/TSVExport
+++ b/share/html/Elements/TSVExport
@@ -62,7 +62,7 @@ $Class ||= $Collection->ColumnMapClassName;
 $r->content_type('application/vnd.ms-excel');
 $r->header_out( 'Content-disposition' => "attachment; filename=$Filename" ) if $Filename;
 
-my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format);
+my $DisplayFormat = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 
 my @Format = $m->comp('/Elements/CollectionAsTable/ParseFormat', Format => $DisplayFormat);
 
diff --git a/share/html/Search/Build.html b/share/html/Search/Build.html
index 03d6411a..c5a5f812 100644
--- a/share/html/Search/Build.html
+++ b/share/html/Search/Build.html
@@ -221,7 +221,7 @@ if ( $NewQuery ) {
     }
     if ( $query{'Format'} ) {
         # Clean unwanted junk from the format
-        $query{'Format'} = $m->comp( '/Elements/ScrubHTML', Content => $query{'Format'} );
+        $query{'Format'} = $m->comp( '/Elements/ScrubHTML', Content => $query{'Format'}, Restrictive => 1 );
     }
 
     if ( !$ARGS{SavedSearchLoad} and ( my $extra_params = $current->{ExtraQueryParams} ) ) {
diff --git a/share/html/Search/Edit.html b/share/html/Search/Edit.html
index a46bfb73..00d78feb 100644
--- a/share/html/Search/Edit.html
+++ b/share/html/Search/Edit.html
@@ -92,7 +92,7 @@ else {
     $title = loc("Edit Query")
 }
 
-$Format = $m->comp('/Elements/ScrubHTML', Content => $Format);
+$Format = $m->comp('/Elements/ScrubHTML', Content => $Format, Restrictive => 1);
 my $QueryString = $m->comp('/Elements/QueryString',
                            Query   => $Query,
                            Format  => $Format,
diff --git a/share/html/Ticket/Graphs/dhandler b/share/html/Ticket/Graphs/dhandler
index a1f45a4c..c553c443 100644
--- a/share/html/Ticket/Graphs/dhandler
+++ b/share/html/Ticket/Graphs/dhandler
@@ -54,6 +54,10 @@ if ( $arg =~ m{^(\d+)$}i ) {
 } else {
     return $m->abort( 404 );
 }
+else {
+    RT->Logger->warning("Invalid URL: $URL");
+    $URL = '';
+}
 
 my $ticket = RT::Ticket->new($session{'CurrentUser'} );
 $ticket->Load( $id );
diff --git a/share/static/js/util.js b/share/static/js/util.js
index e5e93311..4bbb9e4e 100644
--- a/share/static/js/util.js
+++ b/share/static/js/util.js
@@ -643,6 +643,17 @@ function escapeCssSelector(str) {
     return str.replace(/([^A-Za-z0-9_-])/g,'\\$1');
 }
 
+function escapeHTML(str) {
+    return str
+        .replace(/&/g, "&#38;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/\(/g, "&#40;")
+        .replace(/\)/g, "&#41;")
+        .replace(/"/g, "&#34;")
+        .replace(/'/g, "&#39;");
+}
+
 function createCookie(name,value,days) {
     var path = RT.Config.WebPath ? RT.Config.WebPath : "/";
 
@@ -983,7 +994,7 @@ jQuery(function () {
             dataType: "json",
             success : function (results) {
                 jQuery.each(results.actions, function (i, action) {
-                    jQuery.jGrowl(action, { themeState: 'none' });
+                    jQuery.jGrowl(escapeHTML(action), { themeState: 'none' });
                 });
 
                 refreshCollectionListRow(