mirror of
https://github.com/the-djmaze/snappymail.git
synced 2026-11-03 19:08:50 +03:00
b6607bf6e1
DecodeHeaderValue removed CR and LF before decoding encoded-words, so an encoded-word could still decode to a line break. A message whose Message-ID was =?utf-8?b?...?= with CRLF inside reached the client with the break intact, the client copies Message-ID into In-Reply-To when replying or forwarding, and SetInReplyTo only trimmed it. The reply then carried header lines chosen by the sender of the original, or a body if the payload held a blank line, sent and DKIM-signed as the user and saved to Sent. Subject on Edit-as-new had the same shape through the ASCII path. Strip CR, LF and NUL in two places: after decoding in DecodeHeaderValue, and in Header itself, which every outgoing header is built through, so a value that arrives by another route (client parameters, plugins) cannot break the line either. Folding is unaffected; __toString adds it back. test/header-injection.php covers B and Q encoded-words, parsing, outgoing In-Reply-To and Subject, and that long values still fold. |
||
|---|---|---|
| .. | ||
| Base | ||
| Cache | ||
| Imap | ||
| Log | ||
| Mime | ||
| Net | ||
| Sieve | ||
| Smtp | ||
| Config.php | ||
| LICENSE | ||
| RuntimeException.php | ||