HTML content injection in developer signup email

Bug description

The application is rendering the user-controlled tags in an unsafe manner which may allow an attacker to inject malicious HTML code.

Reproduction steps

1. Go to ‘https://developer.bilinfo.net/signup’ (any site would do)
2. Signup. At the email section enter the victims email and at the name section enter the HTML script mentioned below :- {{ <img src=http://tinypic.com/i/tp-logo.jpg>}} . Submit the form
3. Navigate to the corresponding email and you’ll notice that the Name which was an HTML script gets rendered into the mentioned Email.
4. See error

Expected behavior

User input should be HTML-encoded at any point where it is copied into application responses. All HTML meta-characters, including < > " ’ and =, should be replaced with the corresponding HTML entities (< > etc). Application should filter meta characters or HTML tags provided from user input.

Is your portal managed or self-hosted?

Managed

[mikebudzynski]

It will be rolled out with the main API Management service release - you can monitor the link from my previous comment for release notes. We’re still preparing for the roll-out.

[mikebudzynski]

@CosminLazar This change will be included in the next backend release. You can monitor https://aka.ms/apim/releases for release notes.