Harden invitee input and contact names

Security audit found two gaps. Sabre only quotes ICS
parameter values containing space, newline, quote, colon,
semicolon, caret, comma or plus, so a bare carriage
return in a contact name would be written into the
serialized event unquoted and break the line structure;
names with control characters are now dropped. The raw
attendee input and the search query had no length
bound, a huge POST field was fully split, iterated and
echoed back on re-render, a cheap CPU sink; both are
now capped, the query at the longest possible email
fragment.
This commit is contained in:
stefan.tollkuehn committed 2026-10-22 19:33:03 +02:00
1 parent 97cea7e90b
commit 6312c18a91
5 files changed
+83 -4

No files matched your search

+2 -1
View File
@@ -34,7 +34,8 @@
"Invitees": "Teilnehmer",
"Email addresses, comma-separated": "E-Mail-Adressen, durch Kommas getrennt",
"%s is not a valid email address.": "%s ist keine gültige E-Mail-Adresse.",
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen."
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen.",
"Invitee list is too long.": "Die Teilnehmerliste ist zu lang."
},
"pluralForms": "nplurals=2; plural=(n != 1);"
}
+2 -1
View File
@@ -34,7 +34,8 @@
"Invitees": "Teilnehmer",
"Email addresses, comma-separated": "E-Mail-Adressen, durch Kommas getrennt",
"%s is not a valid email address.": "%s ist keine gültige E-Mail-Adresse.",
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen."
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen.",
"Invitee list is too long.": "Die Teilnehmerliste ist zu lang."
},
"pluralForms": "nplurals=2; plural=(n != 1);"
}
+2 -1
View File
@@ -34,7 +34,8 @@
"Invitees": "Invitees",
"Email addresses, comma-separated": "Email addresses, comma-separated",
"%s is not a valid email address.": "%s is not a valid email address.",
"A meeting can invite at most %d people.": "A meeting can invite at most %d people."
"A meeting can invite at most %d people.": "A meeting can invite at most %d people.",
"Invitee list is too long.": "Invitee list is too long."
},
"pluralForms": "nplurals=2; plural=(n != 1);"
}