laminas / laminas-mime

Create and parse MIME messages and parts
https://docs.laminas.dev/laminas-mime/
BSD 3-Clause "New" or "Revised" License
29 stars 23 forks source link

Attachments with longs names are not being processed #28

Closed Ralev93 closed 2 years ago

Ralev93 commented 2 years ago

Bug Report

Q A
Version(s) 2.10.x

Summary

Attachments with filenames, longer than 76 char symbols, are not being processed.

Current behavior

Currently, Laminas\Mail successfully identifies long names and successfully splits them into multiple variables in \Laminas\Mail\Header\ContentDisposition::getFieldValue(). However, the multiple variables do not get recognized in Laminas\Mime\Decode::splitHeaderField() due to this check strcasecmp($name, $wantedPart) i.e. it compares "filename*0" with "filename"

How to reproduce

Try to process an email with an attachment with long name, for example "This___is____long__name.txt"

Expected behavior

It should not compare with strcasecmp, but rather with a regex. Then if it is a multiple value, it should concatenate the values

Suggested fix

    $fullField = [];
    if ($wantedPart) {
        foreach ($matches[1] as $key => $name) {

            if (!preg_match('/' . preg_quote($wantedPart) . "(\*[0-9])*" . '/', $name)) { //support multiname
                continue;
            }

            $val = $matches[2][$key][0] != '"' ? $matches[2][$key] : substr($matches[2][$key], 1, -1);

            // if name and wantedPart doees not match fully(they have matched above in the regex),
            // it means that we have multiple values
            if (strcasecmp($name, $wantedPart) && gettype($val) === 'string') {
                $fullField[$wantedPart] .= $val;
            } else {// name and wantedPart match
                return $val;
            }

        }
        return $fullField[$wantedPart] ?: null;
    }
laminas-bot commented 2 years ago

This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee. If you have a security issue, please follow our security reporting guidelines. If you wish to take on the role of maintainer, please nominate yourself

If you are looking for an actively maintained package alternative, we recommend: