mirror/php-monolog
1
0
Fork 0
mirror of https://github.com/Seldaek/monolog.git synced 2025-08-06 13:16:39 +02:00
Code Issues Releases Wiki Activity

Prevent header injection through content type / encoding in NativeMailerHandler, fixes #458, closes #448

Browse Source
This commit is contained in:
Jordi Boggiano
2014-12-28 14:32:10 +00:00
parent 5bee6fe56c
commit 515a096c86
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Monolog/Handler/NativeMailerHandler.php
View File

@@ -129,6 +129,10 @@ class NativeMailerHandler extends MailHandler
*/
public function setContentType($contentType)
{
if (strpos($contentType, "\n") !== false || strpos($contentType, "\r") !== false) {
throw new \InvalidArgumentException('The content type can not contain newline characters to prevent email header injection');
}
$this->contentType = $contentType;
return $this;
@@ -140,6 +144,10 @@ class NativeMailerHandler extends MailHandler
*/
public function setEncoding($encoding)
{
if (strpos($encoding, "\n") !== false || strpos($encoding, "\r") !== false) {
throw new \InvalidArgumentException('The content type can not contain newline characters to prevent email header injection');
}
$this->encoding = $encoding;
return $this;

18
tests/Monolog/Handler/NativeMailerHandlerTest.php
View File

@@ -40,4 +40,22 @@ class NativeMailerHandlerTest extends TestCase
$mailer = new NativeMailerHandler('spammer@example.org', 'dear victim', 'receiver@example.org');
$mailer->addHeader(array("Content-Type: text/html\r\nFrom: faked@attacker.org"));
}
/**
* @expectedException InvalidArgumentException
*/
public function testSetterContentTypeInjection()
{
$mailer = new NativeMailerHandler('spammer@example.org', 'dear victim', 'receiver@example.org');
$mailer->setContentType("text/html\r\nFrom: faked@attacker.org");
}
/**
* @expectedException InvalidArgumentException
*/
public function testSetterEncodingInjection()
{
$mailer = new NativeMailerHandler('spammer@example.org', 'dear victim', 'receiver@example.org');
$mailer->setEncoding("utf-8\r\nFrom: faked@attacker.org");
}
}