diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2021-05-19 03:13:26 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2021-05-19 03:13:26 +0300 |
| commit | 4617dd64b863df111e33b1b395709f4c2f427350 (patch) | |
| tree | 8b672ecbcc021bf13e50538139b46f3e591914ef | |
| parent | 82840d165144584d1b288521266051a6b5a462eb (diff) | |
| download | nginx-4617dd64b863df111e33b1b395709f4c2f427350.tar.gz nginx-4617dd64b863df111e33b1b395709f4c2f427350.tar.bz2 | |
Mail: stricter checking of IMAP tags.
Only "A-Za-z0-9-._" characters now allowed (which is stricter than what
RFC 3501 requires, but expected to be enough for all known clients),
and tags shouldn't be longer than 32 characters.
| -rw-r--r-- | src/mail/ngx_mail_parse.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c index cc5293093..47c9e3a90 100644 --- a/src/mail/ngx_mail_parse.c +++ b/src/mail/ngx_mail_parse.c @@ -265,6 +265,17 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s) case LF: s->state = sw_start; return NGX_MAIL_PARSE_INVALID_COMMAND; + default: + if ((ch < 'A' || ch > 'Z') && (ch < 'a' || ch > 'z') + && (ch < '0' || ch > '9') && ch != '-' && ch != '.' + && ch != '_') + { + goto invalid; + } + if (p - s->buffer->start > 31) { + goto invalid; + } + break; } break; |