fix(mail): escape angularJS directive for description

This commit is contained in:
Hivert Quentin
2026-08-10 19:34:25 +02:00
parent 78807d01ae
commit 47133fdf3b
19 changed files with 38 additions and 21 deletions
+1 -1
View File
@@ -61,7 +61,7 @@
request = [context request];
params = [[request contentAsString] objectFromJSONString];
name = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
name = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
nameInContainer = nil;
if ([name length] > 0)
+1 -1
View File
@@ -485,7 +485,7 @@ static Class SOGoContactGCSEntryK = Nil;
co = [self clientObject];
card = [co vCard];
request = [context request];
params = [[[request contentAsString] stringWithoutHTMLInjection: YES] objectFromJSONString];
params = [[[request contentAsString] stringWithoutHTMLInjection: YES stripAngular:NO] objectFromJSONString];
forceSave = [[params objectForKey: @"ignoreDuplicate"] boolValue];
[self setAttributes: params];
+1 -1
View File
@@ -339,7 +339,7 @@
[list retain];
request = [context request];
params = [[[request contentAsString] stringWithoutHTMLInjection: YES] objectFromJSONString];
params = [[[request contentAsString] stringWithoutHTMLInjection: YES stripAngular:NO] objectFromJSONString];
o = [params objectForKey: @"refs"];
if (![o isKindOfClass: [NSArray class]])
+1 -1
View File
@@ -587,7 +587,7 @@
//Sanitise the html content
if([d objectForKey:@"content"]){
[d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO] forKey: @"content"];
[d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO stripAngular:YES] forKey: @"content"];
}
return d;
+1 -1
View File
@@ -201,7 +201,7 @@
content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO];
content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO stripAngular:YES];
if ([self respondsToSelector:@selector(getException)]) {
e = [self getException];
}
+2 -2
View File
@@ -79,7 +79,7 @@
request = [context request];
params = [[request contentAsString] objectFromJSONString];
folderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
folderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
if ([folderName length] > 0)
{
encodedFolderName = [folderName stringByEncodingImap4FolderName];
@@ -145,7 +145,7 @@
// Retrieve new folder name from JSON payload
request = [context request];
params = [[request contentAsString] objectFromJSONString];
newFolderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
newFolderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
if (!newFolderName || [newFolderName length] == 0)
{
+1 -1
View File
@@ -1178,7 +1178,7 @@
[msg addObject: [NSNumber numberWithBool: [self isMessageFlagged]]];
// Subject
[msg addObject: [[[self messageSubject] stringWithoutHTMLInjection: YES] stringWithoutHTMLInjection: NO]];
[msg addObject: [[[self messageSubject] stringWithoutHTMLInjection: YES stripAngular:NO] stringWithoutHTMLInjection: NO stripAngular:NO]];
// From
from = [[message objectForKey: @"envelope"] from];
+1 -1
View File
@@ -363,7 +363,7 @@ static NSString *mailETag = nil;
if ([self formattedDate])
[data setObject: [self formattedDate] forKey: @"date"];
if ([self messageSubject])
[data setObject: [[[self messageSubject] stringWithoutHTMLInjection: YES] stringWithoutHTMLInjection: NO] forKey: @"subject"];
[data setObject: [[[self messageSubject] stringWithoutHTMLInjection: YES stripAngular:YES] stringWithoutHTMLInjection: NO stripAngular:YES] forKey: @"subject"];
if ((addresses = [addressFormatter dictionariesForArray: [co fromEnvelopeAddresses]]))
[data setObject: addresses forKey: @"from"];
if ((addresses = [addressFormatter dictionariesForArray: [co toEnvelopeAddresses]]))
+1 -1
View File
@@ -1091,7 +1091,7 @@ static const NSString *kJwtKey = @"jwt";
}
//Check common injection
loginClean = [login stringWithoutHTMLInjection: YES];
loginClean = [login stringWithoutHTMLInjection: YES stripAngular:NO];
if(![loginClean isEqualToString: login])
{
loginClean = @"";
+1 -1
View File
@@ -1750,7 +1750,7 @@ static NSArray *reminderValues = nil;
id o, v;
requestStr = [[context request] contentAsString];
requestStr = [requestStr stringWithoutHTMLInjection: NO];
requestStr = [requestStr stringWithoutHTMLInjection: NO stripAngular:NO];
o = [requestStr objectFromJSONString];
results = nil;
+1 -1
View File
@@ -403,7 +403,7 @@ static SoProduct *commonProduct = nil;
theme = [[context request] formValueForKey: @"theme"];
if ([theme length])
{
safeTheme = [theme stringWithoutHTMLInjection: YES];
safeTheme = [theme stringWithoutHTMLInjection: YES stripAngular:NO];
if([safeTheme isEqualToString: theme])
rel = [NSString stringWithFormat: @"%@?theme=%@", rel, theme];
}
+1 -1
View File
@@ -556,7 +556,7 @@
ex = nil;
request = [context request];
params = [[[request contentAsString] stringWithoutHTMLInjection: NO] objectFromJSONString];
params = [[[request contentAsString] stringWithoutHTMLInjection: NO stripAngular:NO] objectFromJSONString];
if (params == nil)
{
ex = [NSException exceptionWithName: @"JSONParsingException"
+1 -1
View File
@@ -182,7 +182,7 @@ _intValueFromHex (NSString *hexString)
fActiveTasks = [folder activeTasks];
[calendar setObject: folderName forKey: @"id"];
[calendar setObject: [fDisplayName stringWithoutHTMLInjection: YES] forKey: @"name"];
[calendar setObject: [fDisplayName stringWithoutHTMLInjection: YES stripAngular:NO] forKey: @"name"];
[calendar setObject: [folder calendarColor] forKey: @"color"];
isActive = [NSNumber numberWithBool: [folder isActive]];
[calendar setObject: isActive forKey: @"active"];
+1 -1
View File
@@ -335,7 +335,7 @@
ex = nil;
request = [context request];
params = [[[request contentAsString] stringWithoutHTMLInjection: NO] objectFromJSONString];
params = [[[request contentAsString] stringWithoutHTMLInjection: NO stripAngular:NO] objectFromJSONString];
if (params == nil)
{
ex = [NSException exceptionWithName: @"JSONParsingException"
@@ -299,7 +299,7 @@
<label class="pseudo-input-label">
<var:string label:value="Description"/>
</label>
<div>
<div ng-non-bindable="">
<md-content>
<var:string value="authorativeEvent.comment.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
</md-content>