File: fix-insecure-decoding-of-content

package info (click to toggle)
golang-github-protonmail-go-mime 0.0~git20221031.8fd9bc3-2
  • links: PTS, VCS
  • area: main
  • in suites: bookworm, bookworm-backports
  • size: 192 kB
  • sloc: makefile: 2
file content (108 lines) | stat: -rw-r--r-- 3,244 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
Description: Fix insecure decoding of content. 
Use decoder.Bytes() to decode encoded content instead
of insecure custom logic.
Origin: upstream, https://github.com/ProtonMail/go-mime/commit/c287644401b0141618c993df408c045dc46df8ad
Applied-Upstream: https://github.com/ProtonMail/go-mime/commit/c287644401b0141618c993df408c045dc46df8ad
Last-Update: 2023-04-17 <YYYY-MM-DD, last update of the meta-information, optional>
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
Index: golang-github-protonmail-go-mime/encoding.go
===================================================================
--- golang-github-protonmail-go-mime.orig/encoding.go
+++ golang-github-protonmail-go-mime/encoding.go
@@ -1,7 +1,6 @@
 package gomime
 
 import (
-	"bytes"
 	"fmt"
 	"io"
 	"mime"
@@ -11,9 +10,9 @@ import (
 	"unicode/utf8"
 
 	"encoding/base64"
+
 	"golang.org/x/text/encoding"
 	"golang.org/x/text/encoding/htmlindex"
-	"golang.org/x/text/transform"
 )
 
 var wordDec = &mime.WordDecoder{
@@ -189,21 +188,13 @@ func DecodeCharset(original []byte, medi
 		}
 		err = fmt.Errorf("non-utf8 content without charset specification")
 	}
-
 	if err != nil {
 		return original, err
 	}
-
-	utf8 := make([]byte, len(original))
-	nDst, nSrc, err := decoder.Transform(utf8, original, false)
-	for err == transform.ErrShortDst {
-		utf8 = make([]byte, (nDst/nSrc+1)*len(original))
-		nDst, nSrc, err = decoder.Transform(utf8, original, false)
-	}
+	utf8, err := decoder.Bytes(original)
 	if err != nil {
 		return original, err
 	}
-	utf8 = bytes.Trim(utf8, "\x00")
 
 	return utf8, nil
 }
Index: golang-github-protonmail-go-mime/encoding_test.go
===================================================================
--- golang-github-protonmail-go-mime.orig/encoding_test.go
+++ golang-github-protonmail-go-mime/encoding_test.go
@@ -46,6 +46,17 @@ func TestDecodeHeader(t *testing.T) {
 	}
 }
 
+func TestDecodeCharsetBoundaryInputs(t *testing.T) {
+	_, err := DecodeCharset([]byte("\xff"), "text/plain", map[string]string{"charset": "csKOI8R"})
+	if err != nil {
+		t.Error("Expected no error")
+	}
+	_, err = DecodeCharset([]byte("+000000000000000000000000 "), "text/plain", map[string]string{"charset": "utf7"})
+	if err != nil {
+		t.Error("Expected no error")
+	}
+}
+
 func TestGetEncoding(t *testing.T) {
 	// all MIME charset with aliases can be found here https://www.iana.org/assignments/character-sets/character-sets.xhtml
 	mimesets := map[string][]string{
Index: golang-github-protonmail-go-mime/parser_test.go
===================================================================
--- golang-github-protonmail-go-mime.orig/parser_test.go
+++ golang-github-protonmail-go-mime/parser_test.go
@@ -2,7 +2,6 @@ package gomime
 
 import (
 	"bytes"
-	"fmt"
 
 	"io/ioutil"
 	"net/mail"
@@ -322,18 +321,8 @@ TqRoIApQlGggySjCNBAJQcgggEAIFqCCASAklqCC
 
 
 `
-	body, heads, att, attHeads, err := androidParse(testMessage)
+	_, _, _, _, err := androidParse(testMessage)
 	if err != nil {
 		t.Error("parse error", err)
 	}
-
-	fmt.Println("==BODY:")
-	fmt.Println(body)
-	fmt.Println("==BODY HEADERS:")
-	fmt.Println(heads)
-
-	fmt.Println("==ATTACHMENTS:")
-	fmt.Println(att)
-	fmt.Println("==ATTACHMENT HEADERS:")
-	fmt.Println(attHeads)
 }