Fix a security vulnerability: eval used in quoting display name0.11.0.12

This use of eval allows arbitrary remote code execution on
parsing of a maliciously formed email.

Two tests are updated to match the behaviour of the new
code to return the display name - these introduce extra
escaping, so should be innocous.

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/mail_handler/backends/mail_backend.rb b/lib/mail_handler/backends/mail_backend.rb
index 561946980..28c486e1b 100644
--- a/lib/mail_handler/backends/mail_backend.rb
+++ b/lib/mail_handler/backends/mail_backend.rb
@@ -112,7 +112,7 @@ module MailHandler
                     if first_from.is_a?(ActiveSupport::Multibyte::Chars)
                         return nil
                     else
-                        return first_from.display_name ? eval(%Q{"#{first_from.display_name}"}) : nil
+                        return (first_from.display_name || nil)
                     end
                 else
                     return nil