banananetwork
/
roundcubemail
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Sanity checks for header data length in FETCH (#6087)

Browse Source 
Where we know what expected data length is we truncate the input.
pull/6037/merge
Aleksander Machniak 7 years ago
parent 3cdc8af297
commit c0959bd619
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File

10
program/lib/Roundcube/rcube_imap_generic.php
Unescape Escape View File

@ -2504,7 +2504,8 @@ class rcube_imap_generic
switch ($field) { switch ($field) {
case 'date'; case 'date';
$result[$id]->date = $string; $string = substr($string, 0, 128);
$result[$id]->date = $string;
$result[$id]->timestamp = rcube_utils::strtotime($string); $result[$id]->timestamp = rcube_utils::strtotime($string);
break; break;
case 'to': case 'to':
@ -2512,6 +2513,7 @@ class rcube_imap_generic
break; break;
case 'from': case 'from':
case 'subject': case 'subject':
$string = substr($string, 0, 2048);
case 'cc': case 'cc':
case 'bcc': case 'bcc':
case 'references': case 'references':
@ -2521,7 +2523,7 @@ class rcube_imap_generic
$result[$id]->replyto = $string; $result[$id]->replyto = $string;
break; break;
case 'content-transfer-encoding': case 'content-transfer-encoding':
$result[$id]->encoding = $string; $result[$id]->encoding = substr($string, 0, 32);
break; break;
case 'content-type': case 'content-type':
$ctype_parts = preg_split('/[; ]+/', $string); $ctype_parts = preg_split('/[; ]+/', $string);
@ -2536,10 +2538,10 @@ class rcube_imap_generic
case 'return-receipt-to': case 'return-receipt-to':
case 'disposition-notification-to': case 'disposition-notification-to':
case 'x-confirm-reading-to': case 'x-confirm-reading-to':
$result[$id]->mdn_to = $string; $result[$id]->mdn_to = substr($string, 0, 2048);
break; break;
case 'message-id': case 'message-id':
$result[$id]->messageID = $string; $result[$id]->messageID = substr($string, 0, 2048);
break; break;
case 'x-priority': case 'x-priority':
if (preg_match('/^(\d+)/', $string, $matches)) { if (preg_match('/^(\d+)/', $string, $matches)) {

Write Preview
Loading…
Cancel
Save