Skip to content
This repository
Browse code

Fix header stripping.

To/Bcc/Cc need to be prefixed with new lines to be a successful
injection.  Check for that instead of other letters.

Fixes #2484
  • Loading branch information...
commit 83155c04d430825e5b4ac06fc475dafac444efb4 1 parent 359becc
Mark Story authored January 21, 2012
2  cake/libs/controller/components/email.php
@@ -799,7 +799,7 @@ function _formatAddress($string, $smtp = false) {
799 799
  */
800 800
 	function _strip($value, $message = false) {
801 801
 		$search  = '%0a|%0d|Content-(?:Type|Transfer-Encoding)\:';
802  
-		$search .= '|charset\=|mime-version\:|multipart/mixed|(?:[^a-z]to|b?cc)\:.*';
  802
+		$search .= '|charset\=|mime-version\:|multipart/mixed|(?:[\n\r]+to|b?cc)\:.*';
803 803
 
804 804
 		if ($message !== true) {
805 805
 			$search .= '|\r|\n';
5  cake/tests/cases/libs/controller/components/email.test.php
@@ -977,6 +977,11 @@ function testContentStripping() {
977 977
 		$result  = $this->Controller->EmailTest->strip($content, true);
978 978
 		$expected = $content;
979 979
 		$this->assertEqual($result, $expected);
  980
+
  981
+		$content = 'This is a test email to: you and whomever you forward it to';
  982
+		$result  = $this->Controller->EmailTest->strip($content, true);
  983
+		$expected = $content;
  984
+		$this->assertEqual($result, $expected);
980 985
 	}
981 986
 
982 987
 /**

0 notes on commit 83155c0

Please sign in to comment.
Something went wrong with that request. Please try again.