amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-08-29 10:17:35 +00:00
Code Issues Projects Releases Wiki Activity
17,614 Commits 51 Branches 147 Tags
7ce69e3ea7fe35e92378ab27bd1187ef3fdee0b8
Commit Graph
134 Commits
Author SHA1 Message Date
Jan Kahmen 8813677ecb fix(core): keep the @import cleanup working in stringWithoutHTMLInjection 
the trailing while loop reuses the regex variable, which by then points at the
angular brace pattern whenever stripAngular is YES. that pattern has two
capture groups while the loop substitutes $1@im****$3, so NSRegularExpression
raises NSInvalidArgumentException and the NS_HANDLER swallows it.

give the @import pattern its own variable and use it in both the replacement
and the loop. the replacement also used the template of the block above, which
dropped the whole style element instead of masking the @import in place, so
test_stringWithoutHTMLInjection failed. it passes again, and a case with
stripAngular YES covers the loop.
 2026-08-17 23:03:41 +02:00
Hivert Quentin 47133fdf3b fix(mail): escape angularJS directive for description 2026-08-10 19:34:25 +02:00
Hivert Quentin c45233c11e fix(pref): prevent onevent cleaning to remove legitimate words 2026-05-19 09:30:58 +02:00
Hivert Quentin 67ce01ec2a fix(mail): sanitise mail with ics (invitation to event) 2026-05-03 15:08:15 +02:00
Hivert Quentin 981748754a fix(mailer): don't add mailto: to string starting with @ 2025-09-24 09:18:08 +02:00
Hivert Quentin c3234882eb feat(openID): second part with a lot of fixes and cleaning 2025-03-13 15:25:56 +01:00
smizrahi 455fe97cbe feat(core): Add message of the day. Remove all html tags except for anchor tags (mobile only) 2024-01-29 17:16:08 +01:00
smizrahi 2146870071 fix(mail): Fix security @import css injection 2024-01-23 15:01:47 +00:00
Hivert Quentin c872fb4d9c feat(preferences): can set SOGoForwardConstraints to 3 to accept both internal and external domains from SOGoForwardConstraintsDomains 2023-11-10 15:07:14 +01:00
Hivert Quentin 7481ccf370 fix(hmtl): prevent html injection of tag form 2023-11-06 14:04:53 +01:00
smizrahi f9fdad251d fix(mail): Removed invalid HTML tags in mail body. Fixes #5755 2023-06-07 14:42:21 +02:00
smizrahi 6971ebd2d1 fix(security): Security fix for WSTG-INPV-02. Fix assertion on NSRange 2022-11-29 17:34:34 +01:00
smizrahi b1f84891b0 fix(security): Security fix for WSTG-INPV-02. Add unit test. 2022-11-23 09:34:54 +01:00
smizrahi f5c6fcc350 fix(security): Security fix for WSTG-INPV-02. Fix build issue in ubuntu trusty 2022-11-22 17:37:15 +01:00
smizrahi 1e0f5f0089 fix(security): Security fix for WSTG-INPV-02. Add XSS protection on folders and mail title / content 2022-11-22 10:09:41 +01:00
smizrahi dcbfd830d4 fix(security): Security fix for WSTG-INPV-02. Add XSS protection on folders and mail title / content. Fix build issue in ubuntu trusty. 2022-11-18 09:16:40 +01:00
smizrahi 714acfc838 fix(security): Security fix for WSTG-INPV-02. Add XSS protection on folders and mail title / content 2022-11-14 14:36:46 +01:00
Nicolas Höft 3b3e0195b1 (fix) NSString+Utilities: Fix safeStringByEscapingXMLString on gnustep-base-1.28 
Newer gnustep version would add a byte-order-mark on
NSString:dataUsingEncoding:NSUTF32StringEncoding, use NSUTF32LittleEndianStringEncoding
instead to skip the BOM.

Fixes #5416
 2022-08-15 17:06:00 +02:00
Francis Lachapelle a5d18bfced fix(core): improve escaping of double-quotes 
Fixes #5351
 2022-03-29 10:39:09 -04:00
Francis Lachapelle 7c81e3acec fix(core): only escape "%" with the SQL LIKE operator 2022-01-31 14:53:58 -05:00
Francis Lachapelle 969d68dbb6 fix(core): remove trailing closing angle bracket from detected URLs 
Fixes #5465
 2022-01-21 11:07:00 -05:00
Francis Lachapelle b967eac1f3 fix(core): remove trailing closing angle bracket from detected URLs 
Fixes #5465
 2022-01-17 16:43:11 -05:00
Francis Lachapelle 90752c4382 fix(core): remove CR, diacritical marks, variation selectors 2021-08-11 16:33:18 -04:00
Francis Lachapelle 7da4bc465f fix(core): remove overstruck diacritics from sanitized strings 2020-12-15 14:47:51 -05:00
Nicolas Höft fc863bf63f fix: Fix for failing test in NSString+Utilities 
The test in TestNSString+Utilities would otherwise fail:

======================================================================
FAIL: test_countOccurrencesOfString (TestNSString+Utilities.m:46)
----------------------------------------------------------------------
assertion failure

Simply leave the loop early if the substring length is zero to
avoid this issue
 2020-06-03 08:17:08 +02:00
Francis Lachapelle 0e918a446a Add rel="noopener" to external links 
Fixes #4764
 2019-06-10 13:20:44 -04:00
Francis Lachapelle fcdc4c92c0 Improve URLs/emails detection in text mail parts 2019-03-21 11:01:17 -04:00
Francis Lachapelle 15de264967 Web-based management of email certificate (cont'd) 2018-01-12 14:47:31 -05:00
Ludovic Marcotte 8f2bcb6055 (fix) cosmetics 2017-12-23 05:03:18 -05:00
Francis Lachapelle d526efa501 Remove null characters from JSON responses 2017-12-07 16:07:25 -05:00
Ludovic Marcotte 340ddf0ae6 (fix) make sure we safely escape all chars 2016-12-09 10:45:44 -05:00
Ludovic Marcotte 2a2ebd553e (test) handle sanitization before passing data to libxml 2016-12-06 14:05:27 -05:00
Ludovic Marcotte 4ec0615bcd (fix) encore CR for EAS (fixes #3626) 2016-04-14 15:21:49 -04:00
Ludovic Marcotte 5d26175d56 (fix) don't escape \r 2016-04-07 09:27:57 -04:00
Ludovic Marcotte 35d1cab856 (fix) properly XML escape wide characters (fixes #3616) 2016-04-06 11:19:18 -04:00
Patrice Levesque 7c25b53fdf Remove pointless #imports from .m and .h files 
This was done with a brute-force approach, ensuring no additional
warnings from GCC 4.9 under x86_64.
 2016-02-13 16:11:52 -05:00
Ludovic Marcotte 3c0059192d (fix) rewrote the string sanitization to be 32-bit Unicode safe 2016-01-22 20:31:55 -05:00
Ludovic Marcotte b3bc6bb7dc Applied changes coming from v2/PR#184. 2016-01-18 09:26:07 -05:00
Euan Thoms 3c62cc744e Stage 1 of clang compiler warning patches. 2015-10-31 14:10:03 +08:00
Juan VallésandLudovic Marcotte 0982d50643 Improve first character check in CSS identifiers 
A CSS identifier can't start with a digit, so when a folder name does,
a '_' character is appended at the beginning of its CSS identifier.

The check for this first character used the `isdigit()` function, which
takes a `char` argument, while `[self objectAtIndex: 0]` returns a
`unichar`, i.e. a 16-bit unsigned integer. This caused some non-digit
characters to pass this check (e.g. Chinese characters), ending up with
an underscore at the beginning of the folder name.
 2015-09-14 12:55:32 -04:00
Francis Lachapelle a70ea38572 New method [NSString+Utilities asSafeJSString] 2015-06-11 11:44:17 -04:00
Ludovic Marcotte d9896192f3 Revert "Revert "Improve creation of CSS identifier"" 
This reverts commit 7d018221ef.
 2015-06-10 20:05:40 -04:00
Ludovic Marcotte 7d018221ef Revert "Improve creation of CSS identifier" 
This reverts commit e40a19cf89.
 2015-06-10 16:31:15 -04:00
Francis Lachapelle e40a19cf89 Improve creation of CSS identifier 
Now escaping (), [], {}, ", and ;
 2015-06-10 14:02:44 -04:00
Jesús García SáezandJulio García c4b0ac209b NSString:objectFromJSONString now can parse single values 
Like null => [NSNull null]
 2014-11-19 17:12:32 +01:00
Ludovic Marcotte 95b122c912 Simplified even more -safeString 2014-09-29 15:04:40 -04:00
Ludovic Marcotte aa0499dbac Fixed sanitization char skipping and #2936 2014-09-29 14:28:13 -04:00
Ludovic Marcotte 3675220756 Refactored code to be more rigorous Unicode-wise. 2014-09-24 14:14:25 -04:00
Ludovic Marcotte 8ba031d6ec Consider 0x0C as "unsafe" 2014-09-15 19:54:07 -04:00
Ludovic Marcotte c31429a5d5 Also include the BS character in non-safe ones. 2014-05-27 08:45:00 -04:00