Skip to content

Missig zx and email sanitization / validation. #8

@not-a-feature

Description

@not-a-feature

Missing sanitization / validation of the user data. Allowing to inject arbitratry code into the email.
This can be abused to send malicous emails from a trusted domain.

Image

To prevent this use direct input filtering and validation of the zx nick (length, regex, ..) and name.
This would also simplify https://github.com/fsi-tue/hhi/blob/de129958a51823332c06d13f0bf14eaf9d459424/src/register.php#L60C13-L60C174

$mail->addAddress(str_contains($entry["entryZxNick"], "@") ? $entry["entryZxNick"] : ($entry["entryZxNick"] . "@student.uni-tuebingen.de"), $entry["entryName"]);

as we don't need the switch statement anymore.

See: https://www.php.net/function.filter-input

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions