From 64ae21945a69441ad6a58a1069417e7a56cc15f6 Mon Sep 17 00:00:00 2001 From: Mark Longair Date: Mon, 17 Jun 2013 09:53:29 +0100 Subject: Fix a security vulnerability: eval used in quoting display name This use of eval allows arbitrary remote code execution on parsing of a maliciously formed email. Two tests are updated to match the behaviour of the new code to return the display name - these introduce extra escaping, so should be innocous. --- spec/lib/mail_handler/mail_handler_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'spec/lib/mail_handler/mail_handler_spec.rb') diff --git a/spec/lib/mail_handler/mail_handler_spec.rb b/spec/lib/mail_handler/mail_handler_spec.rb index 272b56d0b..d6e7ba5d2 100644 --- a/spec/lib/mail_handler/mail_handler_spec.rb +++ b/spec/lib/mail_handler/mail_handler_spec.rb @@ -223,7 +223,7 @@ describe 'when deriving a name, email and formatted address from a message from it 'should quote a name with quotes in it' do should_render_from_address('"FOI \" Person" ', - ['FOI " Person', + ['FOI \" Person', 'foiperson@localhost', '"FOI \" Person" ']) end -- cgit v1.2.3