laminas / laminas-mime

Create and parse MIME messages and parts
https://docs.laminas.dev/laminas-mime/
BSD 3-Clause "New" or "Revised" License
29 stars 23 forks source link

Adding a duplicate part to a message should not be permitted #19

Open jamesshaw1987 opened 3 years ago

jamesshaw1987 commented 3 years ago

Bug Report

Q A
Version(s) 2.9.0

Summary

The change to use a strict comparison in \Laminas\Mime\Message::addPart (if ($part === $row) {) means that the given $part can contain the exact same data as the existing $row, but an exception will only be throw if they're the same instance. It shouldn't be possible to add two parts containing identical data.

How to reproduce

$part1 = (new \Laminas\Mime\Part('DATA'))->setId('ID');
$part2 = (new \Laminas\Mime\Part('DATA'))->setId('ID');

$message = new \Laminas\Mime\Message();
$message->addPart($part1);
$message->addPart($part2); // should throw \Laminas\Mime\Exception\InvalidArgumentException with message 'Provided part ID already defined.'

Workaround

For now, this can easily be worked around by doing something like:

$message = new \Laminas\Mime\Message();
$message->addPart($part1);

if (in_array($part1, $message->getParts())) {
    return;
}

$message->addPart($part2); 
laminas-bot commented 3 years ago

This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee. If you have a security issue, please follow our security reporting guidelines. If you wish to take on the role of maintainer, please nominate yourself

If you are looking for an actively maintained package alternative, we recommend: