amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-09-28 00:20:32 +00:00
Code Issues Projects Releases Wiki Activity

fix(security): Security fix for WSTG-INPV-02. Add XSS protection on folders and mail title / content

Browse Source
This commit is contained in:
smizrahi
2022-11-14 14:36:46 +01:00
parent 967479335c
commit 714acfc838
9 changed files with 91 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
UI/MailerUI/UIxMailFolderActions.m
+2 -2
View File
@@ -76,7 +76,7 @@
request = [context request];
params = [[request contentAsString] objectFromJSONString];
folderName = [params objectForKey: @"name"];
folderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
if ([folderName length] > 0)
{
encodedFolderName = [folderName stringByEncodingImap4FolderName];
@@ -142,7 +142,7 @@
// Retrieve new folder name from JSON payload
request = [context request];
params = [[request contentAsString] objectFromJSONString];
newFolderName = [params objectForKey: @"name"];
newFolderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
if (!newFolderName || [newFolderName length] == 0)
{