PHPMailer::createHeader: minor tweak to messageID validation (#2391)
Minor improvement to the *massive* improvement from 853afcb858.
The `$` in a regex means "match the end of a string or new line right before the end". Using the `D` modifier prevents the matching on the new line.
Ref:
* https://www.php.net/manual/en/reference.pcre.pattern.modifiers.php
* http://web.archive.org/web/20131226183006/http://blog.php-security.org/archives/76-Holes-in-most-preg_match-filters.html
Co-authored-by: jrfnl <jrfnl@users.noreply.github.com>
This commit is contained in:
parent
853afcb858
commit
3a30a0b963
|
|
@ -2560,7 +2560,7 @@ class PHPMailer
|
|||
'|("(([\x01-\x08\x0B\x0C\x0E-\x1F\x7F]|[\x21\x23-\x5B\x5D-\x7E])' .
|
||||
'|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*"))@(([a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~-]+' .
|
||||
'(\.[a-zA-Z0-9!#$%&\'*+\/=?^_`{|}~-]+)*)|(\[(([\x01-\x08\x0B\x0C\x0E-\x1F\x7F]' .
|
||||
'|[\x21-\x5A\x5E-\x7E])|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*\])))>$/',
|
||||
'|[\x21-\x5A\x5E-\x7E])|(\\[\x01-\x09\x0B\x0C\x0E-\x7F]))*\])))>$/D',
|
||||
$this->MessageID
|
||||
)
|
||||
) {
|
||||
|
|
|
|||
|
|
@ -54,6 +54,7 @@ final class GetLastMessageIDTest extends TestCase
|
|||
'Invalid: plain hash' => [$hash],
|
||||
'Invalid: missing brackets' => [$hash . '@example.com'],
|
||||
'Invalid: missing @' => ['<' . $hash . 'example.com>'],
|
||||
'Invalid: new line after bracket' => ['<' . $hash . "@example.com>\n"],
|
||||
'Invalid: no text before @' => ['<@example.com>'],
|
||||
'Invalid: no text after @' => ['<' . $hash . '@>'],
|
||||
'Invalid: no text before or after @' => ['<@>'],
|
||||
|
|
@ -91,7 +92,7 @@ final class GetLastMessageIDTest extends TestCase
|
|||
$hash = hash('sha256', 12345);
|
||||
|
||||
return [
|
||||
'hashed pre @' => [ '<' . $hash . '@example.com>' ],
|
||||
'hashed pre @' => ['<' . $hash . '@example.com>'],
|
||||
];
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue