|
From: <pdo...@us...> - 2025-04-02 04:06:50
|
Revision: 15038
http://sourceforge.net/p/squirrelmail/code/15038
Author: pdontthink
Date: 2025-04-02 04:06:34 +0000 (Wed, 02 Apr 2025)
Log Message:
-----------
Sanitize part of a header inadvertently included as-is after processing the first part which was encoded (Thanks to yelang123 (@yelang123x) and nga990 (@nga_990)) CVE-2025-30090
Modified Paths:
--------------
trunk/squirrelmail/functions/mime.php
Modified: trunk/squirrelmail/functions/mime.php
===================================================================
--- trunk/squirrelmail/functions/mime.php 2025-04-02 04:02:28 UTC (rev 15037)
+++ trunk/squirrelmail/functions/mime.php 2025-04-02 04:06:34 UTC (rev 15038)
@@ -963,7 +963,9 @@
}
}
- if (!$encoded && $htmlsafe) {
+ // It is possible to slip XSS in here when a header has encoded content followed by unecoded malicious content --- this test was written long ago, but because the leftover $chunk has not been classified or handled in any way, we can't assume it is safe to include as-is.... We'll assume the person who wrote this if() would agree and didn't mean to accidentally allow such and that what they meant was the following corrected line:
+ // if (!$encoded && $htmlsafe) {
+ if ($htmlsafe) {
$ret .= sm_encode_html_special_chars($chunk);
} else {
$ret .= $chunk;
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|