mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-11-08 02:07:09 +00:00
Jordi Mallach
a863283680
AngularJS (EOL since 2022-01) and AngularJS Material no longer receive
security fixes, so any new vulnerability in them will stay unpatched.
In AngularJS, templates are code: any attacker-controlled text that
ends up in a compiled template is evaluated as an expression, and
since 1.6 there is no expression sandbox, so a single
{{constructor.constructor('...')()}} gives full script execution.
SOGo renders untrusted data (mail bodies, invitations, attachment
names, contact fields) into such templates and currently relies on
server-side filtering, like stripping "{{" and "}}", to prevent this.
Any gap in that filtering, or a bypass of $sanitize/ng-bind-html,
would mean XSS in the webmail session: reading and sending mail as
the user, and access to calendars and contacts.
A Content Security Policy adds a second layer in the browser that
doesn't depend on catching every injection. The new
SOGoContentSecurityPolicy system default ("report-only" or "enforce",
disabled when unset) sends a strict policy with the pages of the web
interface:
script-src 'self' 'nonce-<random>' (no 'unsafe-inline'/'unsafe-eval')
style-src 'self' 'unsafe-inline' (Angular Material, CKEditor 5)
object-src 'none'; base-uri 'self'; frame-ancestors 'self'; ...
The policy is generated by sogod, since a fresh 128-bit nonce is needed
per response: it is shared by all components of the response and set
on the inline configuration scripts of the page frame and module views.
The page also gets ng-csp="no-unsafe-eval", so AngularJS evaluates
expressions with its interpreter instead of Function().
With the policy enforced, an expression injected into a compiled
template, such as {{constructor.constructor('...')()}}, can no longer
reach Function() and fails with an EvalError, and injected inline
scripts are blocked. Injected expressions are limited to calling
functions available on the scope.
Tested with Chromium in both modes on login, Mail (HTML messages,
remote content, invitations, compose), Calendar and Contacts editors,
Preferences and Administration: no violations from SOGo's own code.
With the default unset, the generated output is unchanged.
form-action is deliberately not restricted, so SAML2/CAS/OpenID
logins posting to an external IdP keep working. Scripts listed in
SOGoUIAdditionalJSFiles are served from WebServerResources and allowed,
but must not load scripts from other origins, use eval() or rely on
inline handlers; their dependencies have to be installed and listed
alongside them.
Contribute
SOGo is a collaborative effort in order to create the best Free and Open Source groupware solution.
There are multiple ways you can contribute to the project
- Documentation reviews, enhancements and translations
- Feature requests or by sharing your ideas (see the roadmap)
- Participate in the discussion on mailing lists
- Patches for bugs or enhancements
- Provide new translations
Source Code
You can browse the lastest version of the source code online from Alinto's github repository:
To compile SOGo, you first need to obtain the source code of both SOGo and SOPE. The source code of SOPE and SOGo can be obtained from Alinto's github repositories:
The source code of the SOGo Connector extension for Thunderbird 78+ can be obtained from Alinto's github repository:
Please refer to the FAQ for compilation instructions.
Dev Container
A dev container is available to use, read more there read more there
Translations
SOGo and its associated components are available in various languages. The following list describes the official translations alongside their maintainers:
- [en] English - Alinto
- [ar] Arabic - Anass Ahmed
- [eu] Basque - Gorka Gonzalez
- [bs_BA] Bosnian - Refik Bećirović
- [pr_BR] Brazilian Portuguese - Alexandre Marcilio
- [bg] Bulgarian - Todor Todorov
- [ca] Catalan - Hector M. Rulot Segovia
- [zh_CN] Chinese (China) - Thomas Kuiper
- [zh_TW] Chinese (Taiwan)
- [hr_HR] Croatian - Jens Riecken
- [cs] Czech - Šimon Halamásek
- [da_DK] Danish (Denmark) - Altibox
- [nl] Dutch - Roel van Os
- [fi] Finnish - Kari Salmu
- [fr] French - Alinto
- [gl] Galician - Simon Lang
- [de] German - Alexander Greiner-Baer
- [he] Hebrew - Raz Aidlitz
- [hu] Hungarian - Sándor Kuti
- [id] Indonesian - Woka
- [is] Icelandic - Anna Jonna Armannsdottir
- [it] Italian - Alessio Fattorini
- [jp] Japanese - Ryo Yamamoto
- [kk] Kazakh - Nazym Idrissova
- [lv] Latvian - Juris Balandis
- [lt] Lithuanian - Mantas Liobė
- [mk_MK] Macedonian - Miroslav Jovanovic
- [sr_ME] Montenegrin - Ivan Pleskonjić
- [nb_NO] Norwegian (Bokmål) - Jan Ivar Karlsen / Altibox
- [nn_NO] Norwegian (Nynorsk) - Altibox
- [pl] Polish - Paweł Bogusławski
- [pt] Portuguese - Eduardo Crispim
- [ro_RO] Romanian - Vasile Razvan Luca
- [ru] Russian - Alex Kabakaev
- [sr] Serbian - Bogdanović Bojan
- [sr@latin)] Serbian (Latin) - Zlatko Štulić
- [sk] Slovak - Martin Pastor
- [sl_SI] Slovenian - Jens Riecken
- [es_AR] Spanish (Argentina) - Federico Alberto Sayd
- [es_ES] Spanish (Spain) - Dominique Couot
- [sv] Swedish - Peter Johansson
- [tr_TR] Turkish (Turkey) - Muhammed Yalçınkaya, Sinan Kurşunoğlu
- [uk] Ukrainian - Oleksa Stasevych
- [cy] Welsh - Iona Bailey
If you would like to translate the software in an other language, please consult the FAQ.