From e39d4dc20f0d7906f43bd220f553dcef970d07e7 Mon Sep 17 00:00:00 2001 From: Mark Longair Date: Mon, 17 Jun 2013 09:53:29 +0100 Subject: Fix a security vulnerability: eval used in quoting display name This use of eval allows arbitrary remote code execution on parsing of a maliciously formed email. --- lib/mail_handler/backends/mail_backend.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/mail_handler/backends/mail_backend.rb') diff --git a/lib/mail_handler/backends/mail_backend.rb b/lib/mail_handler/backends/mail_backend.rb index 0a12ab3bb..5c54fe7e2 100644 --- a/lib/mail_handler/backends/mail_backend.rb +++ b/lib/mail_handler/backends/mail_backend.rb @@ -77,7 +77,7 @@ module MailHandler if first_from.is_a?(String) return nil else - return first_from.display_name ? eval(%Q{"#{first_from.display_name}"}) : nil + return (first_from.display_name || nil) end else return nil -- cgit v1.2.3