[Vulnerabilities] Spamtrap

[peter-gribanov]

You have a Spamtrap vulnerabilities.

Symfony FOSUserBundle versions:

Actual in Subject from 14 Jan 2012

FOSUserBundle/Resources/translations/FOSUserBundle.en.yml

Line 47 in 8ae256d

subject: Welcome %username%!

And in body from 16 Apr 2011 or older

FOSUserBundle/Resources/translations/FOSUserBundle.en.yml

Line 26 in 9295012

user.email.confirmation: "Welcome %username%!\nHello %username%!\n\nTo finish validating your account - please visit %confir\mationUrl%n\nRegards,\n\nthe Team."

Now it is also relevant:

https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Resources/translations/FOSUserBundle.en.yml#L43

This is relevant for many languages:

FOSUserBundle/Resources/translations/FOSUserBundle.de.yml

Line 47 in 8ae256d

Willkommen %username%!

FOSUserBundle/Resources/translations/FOSUserBundle.fr.yml

Line 47 in 8ae256d

Bienvenue %username% !

FOSUserBundle/Resources/translations/FOSUserBundle.ru.yml

Line 47 in 8ae256d

Добро пожаловать %username%!

Description of the problem including expected versus actual behavior:

Steps to reproduce:

1. Spammer registered with name 900$ PER DAY HERE www.example.com and email [email protected]

2. A real user receives a message:

   Subject: Welcome 900$ PER DAY HERE www.example.com!
   To: [email protected]
   From: "My company" <[email protected]>
   MIME-Version: 1.0
   Content-Type: text/plain; charset=utf-8
   
   Hello 900$ PER DAY HERE www.example.com!
   
   To finish activating your account - please visit https://my-domain.com/register/confirm/...
   
   Regards,
   the Team.
   

3. My domain is banned due to spamming.

PS: Prohibiting the use of spaces in the username is not a solution to the problem.