amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-04-22 05:19:28 +00:00
Code Issues Projects Releases Wiki Activity

fix(security): Security fix for WSTG-INPV-02. Fix NSException where tried to modify NSDictionary. Closes #5651.

Browse Source
This commit is contained in:
smizrahi
2022-12-05 11:45:45 +01:00
parent ed9d247f3e
commit fe9ae12e46
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
SoObjects/SOGo/SOGoUserDefaults.m
View File

@@ -805,9 +805,9 @@ NSString *SOGoPasswordRecoverySecondaryEmail = @"SecondaryEmail";
// Remove possible XSS injection
mailIdentities = [NSMutableArray arrayWithArray: [self arrayForKey: @"SOGoMailIdentities"]];
for (i = 0 ; i < [mailIdentities length] ; i++) {
mailIdentity = [mailIdentities objectAtIndex: i];
if (mailIdentity && [mailIdentity objectForKey: @"fullName"] && [[self arrayForKey: @"SOGoMailIdentities"] isKindOfClass: [NSString class]]) {
fullName = [NSString stringWithString: [self arrayForKey: @"SOGoMailIdentities"]];
mailIdentity = [NSMutableDictionary dictionaryWithDictionary: [mailIdentities objectAtIndex: i]];
if (mailIdentity && [mailIdentity objectForKey: @"fullName"]) {
fullName = [NSString stringWithString: [mailIdentity objectForKey: @"fullName"]];
if (fullName) {
[mailIdentity setObject: [fullName stringWithoutHTMLInjection: YES] forKey: @"fullName"];
[mailIdentities setObject: mailIdentity atIndexedSubscript: i];