amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-03-26 16:42:44 +00:00
Code Issues Projects Releases Wiki Activity

fix(mail): check if smime certificate matches sender address

Browse Source 
Fixes #5407
This commit is contained in:
Francis Lachapelle
2021-11-22 15:31:39 -05:00
parent 28b9224de4
commit e85576cbb7
3 changed files with 26 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
UI/MailPartViewers/UIxMailPartEncryptedViewer.m
View File

@@ -25,6 +25,7 @@
#include <openssl/err.h>
#include <openssl/pkcs7.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#endif
#import <Foundation/NSDictionary.h>
@@ -96,6 +97,7 @@
- (NSData *) _processMessageWith: (NSData *) signedData
{
NSData *output;
NSMutableArray *emails;
STACK_OF(X509) *certs;
X509_STORE *x509Store;
@@ -112,6 +114,7 @@
certs = NULL;
certificates = [NSMutableArray array];
emails = [NSMutableArray array];
validationMessage = nil;
if (p7)
@@ -127,9 +130,16 @@
{
BIO *buf;
char p[1024];
int j;
STACK_OF(OPENSSL_STRING) *emlst;
x = sk_X509_value(certs, i);
emlst = X509_get1_email(x);
for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
[emails addObject: [[NSString stringWithUTF8String: sk_OPENSSL_STRING_value(emlst, j)] lowercaseString]];
X509_email_free(emlst);
memset(p, 0, 1024);
buf = BIO_new(BIO_s_mem());
X509_NAME_print_ex(buf, X509_get_subject_name(x), 0,
@@ -210,42 +220,13 @@
if (validSignature)
{
BOOL hasMatchingAddress;
NSArray *pair;
NSDictionary *certificate, *values;
NSEnumerator *certificatesList, *subjectList;
NSString *senderAddress, *label, *value;
NSString *senderAddress;
validationMessage = [self labelForKey: @"Message is signed"];
hasMatchingAddress = NO;
value = nil;
senderAddress = [[[[[self clientObject] fromEnvelopeAddresses] lastObject] baseEMail] lowercaseString];
certificatesList = [certificates objectEnumerator];
while ((certificate = [certificatesList nextObject]) && !hasMatchingAddress)
if (![emails containsObject: senderAddress])
{
subjectList = [[certificate objectForKey: @"subject"] objectEnumerator];
while ((pair = [subjectList nextObject]) && !hasMatchingAddress)
{
label = [[pair objectAtIndex: 0] lowercaseString];
value = [[pair objectAtIndex: 1] lowercaseString];
if ([label isEqualToString: @"commonname"] && [value isEqualToString: senderAddress])
{
hasMatchingAddress = 1;
}
}
}
if (!hasMatchingAddress)
{
if (value)
{
values = [NSDictionary dictionaryWithObjectsAndKeys: value, @"certificateCn", nil];
validationMessage = [values keysWithFormat: [self labelForKey: @"Message is signed but the certificate (%{certificateCn}) doesn't match the sender email address"]];
}
else
{
validationMessage = [self labelForKey: @"Message is signed but the certificate doesn't match the sender email address"];
}
validationMessage = [self labelForKey: @"Message is signed but the certificate doesn't match the sender email address"];
}
}
else if (!validationMessage)