File apache-commons-email-CVE-2018-1294.patch of Package apache-commons-email.7734

Overview Repositories Revisions Requests Users Attributes Meta

File apache-commons-email-CVE-2018-1294.patch of Package apache-commons-email.7734

Index: commons-email-1.2-src/src/java/org/apache/commons/mail/Email.java
===================================================================
--- commons-email-1.2-src.orig/src/java/org/apache/commons/mail/Email.java
+++ commons-email-1.2-src/src/java/org/apache/commons/mail/Email.java
@@ -1051,7 +1051,7 @@ public abstract class Email
      */
     public Email setSubject(String aSubject)
     {
-        this.subject = aSubject;
+        this.subject = EmailUtils.replaceEndOfLineCharactersWithSpaces(aSubject);
         return this;
     }
 
@@ -1063,7 +1063,23 @@ public abstract class Email
      */
     public Email setBounceAddress(String email)
     {
-        this.bounceAddress = email;
+	if (email != null && !email.isEmpty())
+	{
+	    try
+	    {
+	         this.bounceAddress = createInternetAddress(email, null, this.charset).getAddress();
+	    }
+	    catch (final EmailException e)
+	    {
+	        // Can't throw 'EmailException' to keep backward-compatibility                                                      
+		throw new IllegalArgumentException("Failed to set the bounce address : " + email, e);
+	    }
+	}
+	else
+	    {
+		this.bounceAddress = email;
+	    }
+
         return this;
     }
 
Index: commons-email-1.2-src/src/java/org/apache/commons/mail/EmailUtils.java
===================================================================
--- commons-email-1.2-src.orig/src/java/org/apache/commons/mail/EmailUtils.java
+++ commons-email-1.2-src/src/java/org/apache/commons/mail/EmailUtils.java
@@ -227,6 +227,17 @@ final class EmailUtils
         return buffer.toString();
     }
 
+    /**                                                                                                                  
+     * Replaces end-of-line characters with spaces.                                                                      
+     *                                                                                                                   
+     * @param input the input string to be scanned.                                                                      
+     * @return a clean string                                                                                            
+     */
+     static String replaceEndOfLineCharactersWithSpaces(final String input)
+     {
+	return input == null ? null : input.replace('\n', ' ').replace('\r', ' ');
+     }
+
     /**
      * Convinience method to write a MimeMessage into a file.
      *
Index: commons-email-1.2-src/src/test/org/apache/commons/mail/BaseEmailTestCase.java
===================================================================
--- commons-email-1.2-src.orig/src/test/org/apache/commons/mail/BaseEmailTestCase.java
+++ commons-email-1.2-src/src/test/org/apache/commons/mail/BaseEmailTestCase.java
@@ -85,10 +85,18 @@ public abstract class BaseEmailTestCase
             "A",
             "\uc5ec",
             "0123456789",
-            "012345678901234567890",
-            "\n"
+            "012345678901234567890"
     };
 
+    /** Test characters not acceptable to email */
+    protected String[] endOfLineCombinations =
+    {
+	    "\n",
+	    "\r",
+	    "\r\n",
+	    "\n\r"
+    }
+
     /** Array of test strings */
     protected String[] testCharsNotValid = {"", null};

Places

File apache-commons-email-CVE-2018-1294.patch of Package apache-commons-email.7734

Places