Notifications: small fixes found after reviewer

readthedocs/notifications/messages.py

@@ -1,5 +1,8 @@
 import textwrap
+from collections import defaultdict
 
+import structlog
+from django.utils.html import escape
 from django.utils.translation import gettext_noop as _
 
 from readthedocs.doc_builder.exceptions import (
@@ -13,6 +16,8 @@
 
 from .constants import ERROR, INFO, NOTE, TIP, WARNING
 
+log = structlog.get_logger(__name__)
+
 
 class Message:
     def __init__(self, id, header, body, type, icon_classes=None):
@@ -29,8 +34,18 @@ def __repr__(self):
     def __str__(self):
         return f"Message: {self.id} | {self.header}"
 
+    def _escape_format_values(self, format_values):
+        """
+        Escape all potential HTML tags included in format values.
+
+        This is a protection against rendering potential values defined by the user.
+        It uses the Django's util function ``escape`` (similar to ``|escape`` template tag filter)
+        to convert HTML characters into regular characters.
+        """
+        return {key: escape(value) for key, value in format_values.items()}
+
     def set_format_values(self, format_values):
-        self.format_values = format_values or {}
+        self.format_values = self._escape_format_values(format_values)
 
     def get_display_icon_classes(self):
         if self.icon_classes:
@@ -55,10 +70,20 @@ def get_display_icon_classes(self):
         return " ".join(classes)
 
     def get_rendered_header(self):
-        return self.header.format(**self.format_values)
+        try:
+            return self.header.format(**self.format_values)
+        except KeyError:
+            # There was a key missing
+            log.exception("There was a missing key when formating a header's Message.")
+            return self.header.format_map(defaultdict(str, **self.format_values))
 
     def get_rendered_body(self):
-        return self.body.format(**self.format_values)
+        try:
+            return self.body.format(**self.format_values)
+        except KeyError:
+            # There was a key missing
+            log.exception("There was a missing key when formating a body's Message.")
+            return self.body.format_map(defaultdict(str, **self.format_values))
 
 
 # TODO: review the copy of these notifications/messages on PR review and adapt them.

readthedocs/notifications/tests/test_messages.py

@@ -0,0 +1,32 @@
+from readthedocs.notifications.constants import INFO
+from readthedocs.notifications.messages import Message
+
+
+class TestMessage:
+    def test_xss_protection(self):
+        message = Message(
+            id="test",
+            header="XSS: {header}",
+            body="XSS: {body}",
+            type=INFO,
+        )
+        message.set_format_values(
+            {
+                "header": "<p>xss</p>",
+                "body": "<span>xss</span>",
+            }
+        )
+
+        assert message.get_rendered_header() == "XSS: &lt;p&gt;xss&lt;/p&gt;"
+        assert message.get_rendered_body() == "XSS: &lt;span&gt;xss&lt;/span&gt;"
+
+    def test_missing_key_format_values(self):
+        message = Message(
+            id="test",
+            header="Missing format value: {header}",
+            body="Missing format value: {body}",
+            type=INFO,
+        )
+
+        assert message.get_rendered_header() == "Missing format value: "
+        assert message.get_rendered_body() == "Missing format value: "

readthedocs/subscriptions/notifications.py

@@ -93,7 +93,7 @@ def for_organizations(cls):
         body=_(
             textwrap.dedent(
                 """
-            The organization "{instance.name}" is currently disabled. You need to <a href="{{ subscription_url }}">renew your subscription</a> to keep using Read the Docs
+            The organization "{instance.name}" is currently disabled. You need to <a href="{subscription_url}">renew your subscription</a> to keep using Read the Docs
             """
             ).strip(),
         ),