Improper handling of escaped separator characters in VCards

[rcubetrac]

Reported by mgrum on 4 Jan 2013 14:41 UTC as Trac ticket #1488896

When importing VCards into Roundcube, the function vcard_unquote in the file program/lib/Roundcube/rcube_vcard.php splits the VCard entries (especially the N entry) into parts that are separated by ";" or any other separation character. This function however doesn't handle escaped separator characters correctly.

What the function does is replace every occurrence of ";" by the bell character "\007" using strtr, then split the string into parts and then replace the bell characters by ";" inside these parts, again using strtr. This works in most cases, but it will fail when the "" before the ";" is escaped itself.

So for example if I enter "test" as the surname for a contact, then export it into a VCard (using any mail client that properly escapes the "" as "") and then try to import it in Roundcube, the ";" after the "" will be seen as escaped, although it is not.

The only solution to this is IMO to throw out strtr and instead loop through the string while storing the escape state in a separate variable. I wrote a function that does exactly this. It can be copied directly into the Roundcube source and used instead of strtr:

function vcard_replace_escaped_separators($s, $sep = ';') {
$out = "";
$escaped = false;

foreach(str_split($s) as $cur_char) {
if(!$escaped && $cur_char == "") {
$escaped = true;
} elseif (!$escaped) {
$out .= $cur_char;
} elseif ($escaped && $cur_char == $sep) {
$out .= "\007";
$escaped = false;
} else {
$out .= "" . $cur_char;
$escaped = false;
}
}

return $out;
}

Keywords: VCard
Migrated-From: http://trac.roundcube.net/ticket/1488896

[rcubetrac]

Comment by mgrum on 4 Jan 2013 14:47 UTC

Whoops, seems like Trac doesn't display my code correcty because it contains double backslashes (as well as part of my text). Anyway, I have added the function as an attachment now.

[rcubetrac]

Comment by @alecpl on 5 Jan 2013 17:20 UTC

Test added in 2c777be.

[rcubetrac]

Milestone changed by @alecpl on 5 Jan 2013 17:20 UTC

later => 0.9-beta

[rcubetrac]

Comment by @alecpl on 5 Jan 2013 19:18 UTC

Fixed in 21106b3.

[rcubetrac]

Status changed by @alecpl on 5 Jan 2013 19:18 UTC

new => closed