Harden invitee input and contact names
Security audit found two gaps. Sabre only quotes ICS parameter values containing space, newline, quote, colon, semicolon, caret, comma or plus, so a bare carriage return in a contact name would be written into the serialized event unquoted and break the line structure; names with control characters are now dropped. The raw attendee input and the search query had no length bound, a huge POST field was fully split, iterated and echoed back on re-render, a cheap CPU sink; both are now capped, the query at the longest possible email fragment.
This commit is contained in:
1 parent
97cea7e90b
commit
6312c18a91
5 files changed
+83
-4
No files matched your search
+2
-1
@@ -34,7 +34,8 @@
|
||||
"Invitees": "Teilnehmer",
|
||||
"Email addresses, comma-separated": "E-Mail-Adressen, durch Kommas getrennt",
|
||||
"%s is not a valid email address.": "%s ist keine gültige E-Mail-Adresse.",
|
||||
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen."
|
||||
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen.",
|
||||
"Invitee list is too long.": "Die Teilnehmerliste ist zu lang."
|
||||
},
|
||||
"pluralForms": "nplurals=2; plural=(n != 1);"
|
||||
}
|
||||
+2
-1
@@ -34,7 +34,8 @@
|
||||
"Invitees": "Teilnehmer",
|
||||
"Email addresses, comma-separated": "E-Mail-Adressen, durch Kommas getrennt",
|
||||
"%s is not a valid email address.": "%s ist keine gültige E-Mail-Adresse.",
|
||||
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen."
|
||||
"A meeting can invite at most %d people.": "Ein Meeting kann höchstens %d Personen einladen.",
|
||||
"Invitee list is too long.": "Die Teilnehmerliste ist zu lang."
|
||||
},
|
||||
"pluralForms": "nplurals=2; plural=(n != 1);"
|
||||
}
|
||||
+2
-1
@@ -34,7 +34,8 @@
|
||||
"Invitees": "Invitees",
|
||||
"Email addresses, comma-separated": "Email addresses, comma-separated",
|
||||
"%s is not a valid email address.": "%s is not a valid email address.",
|
||||
"A meeting can invite at most %d people.": "A meeting can invite at most %d people."
|
||||
"A meeting can invite at most %d people.": "A meeting can invite at most %d people.",
|
||||
"Invitee list is too long.": "Invitee list is too long."
|
||||
},
|
||||
"pluralForms": "nplurals=2; plural=(n != 1);"
|
||||
}
|
||||
Reference in new issue
Block a user