diff options
author | Steve Bennetts <steve@lindenlab.com> | 2009-10-23 12:17:30 -0700 |
---|---|---|
committer | Steve Bennetts <steve@lindenlab.com> | 2009-10-23 12:17:30 -0700 |
commit | 80b682d4b4dd1256ee09dd3327d2c51e3adee0b5 (patch) | |
tree | 751731e4b23e08264caf6436ae2c60cff8094240 /indra/llmessage/llmail.cpp | |
parent | b43771cad585cb9820941eb1b24b67390eaa9435 (diff) | |
parent | 127b428863707c882fbf4d30699321b8a2365644 (diff) |
merge
Diffstat (limited to 'indra/llmessage/llmail.cpp')
-rw-r--r-- | indra/llmessage/llmail.cpp | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/indra/llmessage/llmail.cpp b/indra/llmessage/llmail.cpp index d52ff6c7e8..ce206d8d7d 100644 --- a/indra/llmessage/llmail.cpp +++ b/indra/llmessage/llmail.cpp @@ -265,7 +265,7 @@ std::string LLMail::buildSMTPTransaction( // static bool LLMail::send( const std::string& header, - const std::string& message, + const std::string& raw_message, const char* from_address, const char* to_address) { @@ -276,8 +276,20 @@ bool LLMail::send( return false; } - // *FIX: this translation doesn't deal with a single period on a - // line by itself. + // remove any "." SMTP commands to prevent injection (DEV-35777) + // we don't need to worry about "\r\n.\r\n" because of the + // "\n" --> "\n\n" conversion going into rfc2822_msg below + std::string message = raw_message; + std::string bad_string = "\n.\n"; + std::string good_string = "\n..\n"; + while (1) + { + int index = message.find(bad_string); + if (index == std::string::npos) break; + message.replace(index, bad_string.size(), good_string); + } + + // convert all "\n" into "\r\n" std::ostringstream rfc2822_msg; for(U32 i = 0; i < message.size(); ++i) { |