Skip to content

Commit 948555a

Browse files
bbottemabbottema
committed
#271: don't encode filenames anymore, but do make sure all attachment/image file names are tested for injection attacks. Update the master demo
1 parent 3540c7b commit 948555a

File tree

4 files changed

+25
-22
lines changed

4 files changed

+25
-22
lines changed

‎modules/simple-java-mail/src/main/java/org/simplejavamail/converter/internal/mimemessage/MimeMessageHelper.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -231,8 +231,8 @@ private static BodyPart getBodyPartFromDatasource(final AttachmentResource attac
231231
throws MessagingException {
232232
final BodyPart attachmentPart = new MimeBodyPart();
233233
// setting headers isn't working nicely using the javax mail API, so let's do that manually
234-
final String resourceName = determineResourceName(attachmentResource, false);
235-
final String fileName = determineResourceName(attachmentResource, true);
234+
final String resourceName = determineResourceName(attachmentResource, false, true);
235+
final String fileName = determineResourceName(attachmentResource, true, false);
236236
attachmentPart.setDataHandler(new DataHandler(new NamedDataSource(fileName, attachmentResource.getDataSource())));
237237
attachmentPart.setFileName(fileName);
238238
final String contentType = attachmentResource.getDataSource().getContentType();
@@ -248,7 +248,7 @@ private static BodyPart getBodyPartFromDatasource(final AttachmentResource attac
248248
/**
249249
* Determines the right resource name and optionally attaches the correct extension to the name. The result is mime encoded.
250250
*/
251-
static String determineResourceName(final AttachmentResource attachmentResource, final boolean includeExtension) {
251+
static String determineResourceName(final AttachmentResource attachmentResource, final boolean includeExtension, final boolean encodeResourceName) {
252252
final String datasourceName = attachmentResource.getDataSource().getName();
253253

254254
String resourceName;
@@ -265,7 +265,7 @@ static String determineResourceName(final AttachmentResource attachmentResource,
265265
} else if (!includeExtension && resourceName.contains(".") && resourceName.equals(datasourceName)) {
266266
resourceName = removeExtension(resourceName);
267267
}
268-
return MiscUtil.encodeText(resourceName);
268+
return encodeResourceName ? MiscUtil.encodeText(resourceName) : resourceName;
269269
}
270270

271271
@NotNull

‎modules/simple-java-mail/src/main/java/org/simplejavamail/mailer/MailerHelper.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,9 +84,11 @@ public static boolean validate(@NotNull final Email email, @NotNull final EnumSe
8484
}
8585
for (final AttachmentResource attachment : email.getAttachments()) {
8686
scanForInjectionAttack(attachment.getName(), "email.attachment.name");
87+
scanForInjectionAttack(attachment.getDataSource().getName(), "email.attachment.datasource.name");
8788
}
8889
for (final AttachmentResource embeddedImage : email.getEmbeddedImages()) {
8990
scanForInjectionAttack(embeddedImage.getName(), "email.embeddedImage.name");
91+
scanForInjectionAttack(embeddedImage.getDataSource().getName(), "email.embeddedImage.datasource.name");
9092
}
9193
scanForInjectionAttack(email.getFromRecipient().getName(), "email.fromRecipient.name");
9294
scanForInjectionAttack(email.getFromRecipient().getAddress(), "email.fromRecipient.address");

‎modules/simple-java-mail/src/test/java/demo/FullEmailDemoApp.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
import javax.mail.internet.MimeMessage;
1111
import javax.mail.util.ByteArrayDataSource;
1212
import java.io.IOException;
13-
import java.nio.charset.Charset;
13+
import static java.nio.charset.Charset.defaultCharset;
1414

1515
import static demo.ResourceFolderHelper.determineResourceFolder;
1616

@@ -63,7 +63,8 @@ private static void testMixedRelatedAlternativeIncludingCalendarAndMessageParsin
6363

6464
// add two text files in different ways and a black thumbs up embedded image ->
6565
emailPopulatingBuilderNormal.withAttachment("dresscode.txt", new ByteArrayDataSource("Black Tie Optional", "text/plain"));
66-
emailPopulatingBuilderNormal.withAttachment("location.txt", "On the moon!".getBytes(Charset.defaultCharset()), "text/plain");
66+
emailPopulatingBuilderNormal.withAttachment("location.txt", "On the moon!".getBytes(defaultCharset()), "text/plain");
67+
emailPopulatingBuilderNormal.withAttachment("special_łąąśćńółęĄŻŹĆŃÓŁĘ.txt", "doorcode: Ken sent me".getBytes(defaultCharset()), "text/plain");
6768
emailPopulatingBuilderNormal.withEmbeddedImage("thumbsup", produceThumbsUpImage(), "image/png");
6869
emailPopulatingBuilderNormal.withCalendarText(CalendarMethod.REQUEST, CalendarHelper.createCalendarEvent());
6970

‎modules/simple-java-mail/src/test/java/org/simplejavamail/converter/internal/mimemessage/MimeMessageHelperTest.java‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -45,64 +45,64 @@ public void setup() {
4545
public void determineResourceName1()
4646
throws IOException {
4747
AttachmentResource resource1 = new AttachmentResource(null, getDataSource("blahblah"));
48-
assertThat(MimeMessageHelper.determineResourceName(resource1, false)).isEqualTo("blahblah");
49-
assertThat(MimeMessageHelper.determineResourceName(resource1, true)).isEqualTo("blahblah");
48+
assertThat(MimeMessageHelper.determineResourceName(resource1, false, true)).isEqualTo("blahblah");
49+
assertThat(MimeMessageHelper.determineResourceName(resource1, true, true)).isEqualTo("blahblah");
5050
}
5151

5252
@Test
5353
public void determineResourceName2()
5454
throws IOException {
5555
AttachmentResource resource2 = new AttachmentResource(null, getDataSource("blahblah.txt"));
56-
assertThat(MimeMessageHelper.determineResourceName(resource2, false)).isEqualTo("blahblah");
57-
assertThat(MimeMessageHelper.determineResourceName(resource2, true)).isEqualTo("blahblah.txt");
56+
assertThat(MimeMessageHelper.determineResourceName(resource2, false, true)).isEqualTo("blahblah");
57+
assertThat(MimeMessageHelper.determineResourceName(resource2, true, true)).isEqualTo("blahblah.txt");
5858
}
5959

6060
@Test
6161
public void determineResourceName3()
6262
throws IOException {
6363
AttachmentResource resource3 = new AttachmentResource("the resource", getDataSource(null));
64-
assertThat(MimeMessageHelper.determineResourceName(resource3, false)).isEqualTo("the resource");
65-
assertThat(MimeMessageHelper.determineResourceName(resource3, true)).isEqualTo("the resource");
64+
assertThat(MimeMessageHelper.determineResourceName(resource3, false, true)).isEqualTo("the resource");
65+
assertThat(MimeMessageHelper.determineResourceName(resource3, true, true)).isEqualTo("the resource");
6666
}
6767

6868
@Test
6969
public void determineResourceName4()
7070
throws IOException {
7171
AttachmentResource resource4 = new AttachmentResource("the resource", getDataSource("blahblah.txt"));
72-
assertThat(MimeMessageHelper.determineResourceName(resource4, false)).isEqualTo("the resource");
73-
assertThat(MimeMessageHelper.determineResourceName(resource4, true)).isEqualTo("the resource.txt");
72+
assertThat(MimeMessageHelper.determineResourceName(resource4, false, true)).isEqualTo("the resource");
73+
assertThat(MimeMessageHelper.determineResourceName(resource4, true, true)).isEqualTo("the resource.txt");
7474
}
7575

7676
@Test
7777
public void determineResourceName5()
7878
throws IOException {
7979
AttachmentResource resource5 = new AttachmentResource("the resource", getDataSource("blahblah"));
80-
assertThat(MimeMessageHelper.determineResourceName(resource5, false)).isEqualTo("the resource");
81-
assertThat(MimeMessageHelper.determineResourceName(resource5, true)).isEqualTo("the resource");
80+
assertThat(MimeMessageHelper.determineResourceName(resource5, false, true)).isEqualTo("the resource");
81+
assertThat(MimeMessageHelper.determineResourceName(resource5, true, true)).isEqualTo("the resource");
8282
}
8383

8484
@Test
8585
public void determineResourceName6()
8686
throws IOException {
8787
AttachmentResource resource6 = new AttachmentResource("the resource.txt", getDataSource("blahblah.txt"));
88-
assertThat(MimeMessageHelper.determineResourceName(resource6, false)).isEqualTo("the resource.txt");
89-
assertThat(MimeMessageHelper.determineResourceName(resource6, true)).isEqualTo("the resource.txt");
88+
assertThat(MimeMessageHelper.determineResourceName(resource6, false, true)).isEqualTo("the resource.txt");
89+
assertThat(MimeMessageHelper.determineResourceName(resource6, true, true)).isEqualTo("the resource.txt");
9090
}
9191

9292
@Test
9393
public void determineResourceName7()
9494
throws IOException {
9595
AttachmentResource resource7 = new AttachmentResource("the resource.txt", getDataSource("blahblah"));
96-
assertThat(MimeMessageHelper.determineResourceName(resource7, false)).isEqualTo("the resource.txt");
97-
assertThat(MimeMessageHelper.determineResourceName(resource7, true)).isEqualTo("the resource.txt");
96+
assertThat(MimeMessageHelper.determineResourceName(resource7, false, true)).isEqualTo("the resource.txt");
97+
assertThat(MimeMessageHelper.determineResourceName(resource7, true, true)).isEqualTo("the resource.txt");
9898
}
9999

100100
@Test
101101
public void determineResourceName_ignoreExtensionFromResource()
102102
throws IOException {
103103
AttachmentResource resource7 = new AttachmentResource("the resource.txt", getDataSource("blahblah.1/www/get?id=3"));
104-
assertThat(MimeMessageHelper.determineResourceName(resource7, false)).isEqualTo("the resource.txt");
105-
assertThat(MimeMessageHelper.determineResourceName(resource7, true)).isEqualTo("the resource.txt");
104+
assertThat(MimeMessageHelper.determineResourceName(resource7, false, true)).isEqualTo("the resource.txt");
105+
assertThat(MimeMessageHelper.determineResourceName(resource7, true, true)).isEqualTo("the resource.txt");
106106
}
107107

108108
private ByteArrayDataSource getDataSource(@Nullable String name)

0 commit comments

Comments
 (0)