From 06dbc0b9e05b1db03c979c7900bfe0d0844155a4 Mon Sep 17 00:00:00 2001 From: Mark Longair Date: Mon, 17 Jun 2013 09:53:29 +0100 Subject: Fix a security vulnerability: eval used in quoting display name This use of eval allows arbitrary remote code execution on parsing of a maliciously formed email. --- lib/mail_handler/backends/mail_backend.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/mail_handler/backends/mail_backend.rb') diff --git a/lib/mail_handler/backends/mail_backend.rb b/lib/mail_handler/backends/mail_backend.rb index b75e6ed63..905315f1f 100644 --- a/lib/mail_handler/backends/mail_backend.rb +++ b/lib/mail_handler/backends/mail_backend.rb @@ -78,7 +78,7 @@ module MailHandler if first_from.is_a?(String) return nil else - return first_from.display_name ? eval(%Q{"#{first_from.display_name}"}) : nil + return (first_from.display_name || nil) end else return nil -- cgit v1.2.3