Merge branch 'security/zf2016-04'

Fixes ZF2016-04
zendframework · Dec 19, 2016 · 8d18478 · glensc · Apr 3, 2017 · Ocramius
2 parents 85c3802 + 7260c97
commit 8d18478
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 0 deletions.
diff --git a/src/Transport/Sendmail.php b/src/Transport/Sendmail.php
@@ -225,6 +225,16 @@ protected function prepareHeaders(Mail\Message $message)
         $headers = clone $message->getHeaders();
         $headers->removeHeader('To');
         $headers->removeHeader('Subject');
+
+        // Sanitize the From header
+        $from = $headers->get('From');
+        if ($from) {
+            foreach ($from->getAddressList() as $address) {
+                if (preg_match('/\\\"/', $address->getEmail())) {
+                    throw new Exception\RuntimeException('Potential code injection in From header');
+                }
+            }
+        }
         return $headers->toString();
     }
 

diff --git a/test/Transport/SendmailTest.php b/test/Transport/SendmailTest.php
@@ -10,6 +10,7 @@
 namespace ZendTest\Mail\Transport;
 
 use Zend\Mail\Message;
+use Zend\Mail\Transport\Exception\RuntimeException;
 use Zend\Mail\Transport\Sendmail;
 
 /**
@@ -133,4 +134,28 @@ public function testAssertSubjectEncoded()
         $this->transport->send($message);
         $this->assertEquals('=?UTF-8?Q?Testing=20Zend\Mail\Transport\Sendmail?=', $this->subject);
     }
+
+    public function testCodeInjectionInFromHeader()
+    {
+        $message = $this->getMessage();
+        $message->setBody('This is the text of the email.');
+        $message->setFrom('"AAA\" code injection"@domain', 'Sender\'s name');
+        $message->addTo('hacker@localhost', 'Name of recipient');
+        $message->setSubject('TestSubject');
+
+        $this->setExpectedException(RuntimeException::class);
+        $this->transport->send($message);
+    }
+
+    public function testValidEmailLocaDomainInFromHeader()
+    {
+        $message = $this->getMessage();
+        $message->setBody('This is the text of the email.');
+        $message->setFrom('"foo-bar"@domain', 'Foo Bar');
+        $message->addTo('hacker@localhost', 'Name of recipient');
+        $message->setSubject('TestSubject');
+
+        $this->transport->send($message);
+        $this->assertContains('From: Foo Bar <"foo-bar"@domain>', $this->additional_headers);
+    }
 }