diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2021-05-19 03:13:26 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2021-05-19 03:13:26 +0300 |
| commit | 4617dd64b863df111e33b1b395709f4c2f427350 (patch) | |
| tree | 8b672ecbcc021bf13e50538139b46f3e591914ef /src | |
| parent | 82840d165144584d1b288521266051a6b5a462eb (diff) | |
| download | nginx-4617dd64b863df111e33b1b395709f4c2f427350.tar.gz nginx-4617dd64b863df111e33b1b395709f4c2f427350.tar.bz2 | |
Mail: stricter checking of IMAP tags.
Only "A-Za-z0-9-._" characters now allowed (which is stricter than what
RFC 3501 requires, but expected to be enough for all known clients),
and tags shouldn't be longer than 32 characters.
Diffstat (limited to 'src')
| -rw-r--r-- | src/mail/ngx_mail_parse.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/mail/ngx_mail_parse.c b/src/mail/ngx_mail_parse.c index cc5293093..47c9e3a90 100644 --- a/src/mail/ngx_mail_parse.c +++ b/src/mail/ngx_mail_parse.c @@ -265,6 +265,17 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s) case LF: s->state = sw_start; return NGX_MAIL_PARSE_INVALID_COMMAND; + default: + if ((ch < 'A' || ch > 'Z') && (ch < 'a' || ch > 'z') + && (ch < '0' || ch > '9') && ch != '-' && ch != '.' + && ch != '_') + { + goto invalid; + } + if (p - s->buffer->start > 31) { + goto invalid; + } + break; } break; |