PHPMailer::createHeader: minor tweak to messageID validation (#2391)

Minor improvement to the *massive* improvement from 853afcb858.

The `$` in a regex means "match the end of a string or new line right before the end". Using the `D` modifier prevents the matching on the new line.

Ref:
* https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php
* http://web.archive.org/web/20131226183006/http://blog.php-security.org/archives/76-Holes-in-most-preg_match-filters.html

Co-authored-by: jrfnl <jrfnl@users.noreply.github.com>
This commit is contained in:
Juliette 2021-06-28 10:05:36 +02:00 committed by GitHub
parent 853afcb858
commit 3a30a0b963
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 2 deletions

View File

@ -2560,7 +2560,7 @@ class PHPMailer
'|("(([\x01-\x08\x0B\x0C\x0E-\x1F\x7F]|[\x21\x23-\x5B\x5D-\x7E])' .
'|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*"))@(([a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~-]+' .
'(\.[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~-]+)*)|(\[(([\x01-\x08\x0B\x0C\x0E-\x1F\x7F]' .
'|[\x21-\x5A\x5E-\x7E])|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*\])))>$/',
'|[\x21-\x5A\x5E-\x7E])|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*\])))>$/D',
$this->MessageID
)
) {

View File

@ -54,6 +54,7 @@ final class GetLastMessageIDTest extends TestCase
'Invalid: plain hash' => [$hash],
'Invalid: missing brackets' => [$hash . '@example.com'],
'Invalid: missing @' => ['<' . $hash . 'example.com>'],
'Invalid: new line after bracket' => ['<' . $hash . "@example.com>\n"],
'Invalid: no text before @' => ['<@example.com>'],
'Invalid: no text after @' => ['<' . $hash . '@>'],
'Invalid: no text before or after @' => ['<@>'],
@ -91,7 +92,7 @@ final class GetLastMessageIDTest extends TestCase
$hash = hash('sha256', 12345);
return [
'hashed pre @' => [ '<' . $hash . '@example.com>' ],
'hashed pre @' => ['<' . $hash . '@example.com>'],
];
}