[FIX] Prevent header injection with MIME4J DOM

[chibenwa]

No description provided.

[jochenw]

Is it really necessary, to pull in a new dependency (assert4j) to do stuff, that JUnit does as well? I suggest, that you remove assert4j.

[chibenwa]

Hi!
Thanks for the feedback.
As it only is a test dependency, library users are non impacted.
I pulled the dependency in mime4j core for 3 reason:

• asserting exceptions with junit alone is painful
• we are using already assertj in mime4j dom
• and this library is used everywhere in james code base as well.
  As such using it in this context seems reasonbable to me.

[carnil]

This should be CVE-2024-21742

[jim-krueger]

Hi,
I'm questioning if this fix is actually complete. In this PR you've added validation code the the RawField public constructor. And while the public constructor does invoke the default constructor there is no validation in that constructor. So any code that directly invokes the default constructor could still experience the problem this PR addresses.
Here is an example stack demonstrating my point:

java.lang.Throwable
    at org.apache.james.mime4j.stream.RawField.<init>(RawField.java:47)
    at org.apache.james.mime4j.stream.RawFieldParser.parseField(RawFieldParser.java:71)
    at org.apache.james.mime4j.stream.DefaultFieldBuilder.build(DefaultFieldBuilder.java:95)
    at org.apache.james.mime4j.stream.MimeEntity.nextField(MimeEntity.java:276)
    at org.apache.james.mime4j.stream.MimeEntity.advance(MimeEntity.java:312)
    at org.apache.james.mime4j.stream.MimeTokenStream.next(MimeTokenStream.java:375)
    at org.apache.james.mime4j.parser.MimeStreamParser.parse(MimeStreamParser.java:177)

[chibenwa]

Thanks for raising the point.

And while the public constructor does invoke the default constructor there is no validation in that constructor.

I protected the constructors called by the DOM builders.

The others are called by the parsers that would naturally consider newlines as new header.

I must confess I did not do fuzzing on this and only wrote simple unit tests. If you happen to find one faulty value please provide (ideally to private@james.apache.org) a reproduction unit test (and a fix?)

I've been voluntarily limiting the scope of the change in order to avoid a regression on "mime4j core" as well.