djmaze 099ee3b97e @ZaphodB fix(@security): S/MIME actions put the client's part id into IMAP FETCH as is ... DoSMimeDecryptMessage and DoSMimeVerifyMessage built BODY.PEEK[<partId>] (and [<partId>.MIME]) from the partId / sigPartId parameters without checking them, so a value could close the bracket or the line and add IMAP commands of its own. They run in the user's own IMAP session, so this is not cross-account, but nothing in that session should be steerable by a request parameter. Read both through smimePartIdParam(), which accepts only an IMAP section number (1, 1.2.10) or TEXT and refuses anything else. test/smime-partid.php checks valid ids pass and injection attempts, zero or leading-zero sections, lowercase and other section keywords are refused.		2026-10-27 22:50:28 +01:00
..
carddav.php	Test CardDAV for #79	2021-04-15 12:41:01 +02:00
crypt-forgery.php	Resolve test load path	2026-10-27 01:33:48 +01:00
header-injection.php	Resolve test load path	2026-10-27 01:33:48 +01:00
raw-inline-type.php	Resolve test load path	2026-10-27 01:33:48 +01:00
sasl.php	Resolve #695	2022-11-23 16:26:26 +01:00
smime-partid.php	@ZaphodB fix(@security): S/MIME actions put the client's part id into IMAP FETCH as is	2026-10-27 22:50:28 +01:00
smime-verify.php	Resolve test load path	2026-10-27 01:33:48 +01:00
sso.php	Resolve test load path	2026-10-27 01:33:48 +01:00
ssrf-ranges.php	@ZaphodB fix(security): SSRF gate let through CGNAT, multicast and the server's own IPs	2026-10-27 01:30:31 +01:00
two-factor-reauth.php	@ZaphodB fix(security): two-factor-auth could be switched off with only a session	2026-10-27 22:27:03 +01:00