the-djmaze / snappymail

Simple, modern & fast web-based email client
https://snappymail.eu
GNU Affero General Public License v3.0
933 stars 111 forks source link

Properly escape path separator in `tar.php` file list regex #1562

Closed sevmonster closed 2 months ago

sevmonster commented 2 months ago

In tar.php, the regex delimiter / is not properly escaped when building the $files regex list. This results in the incorrect regex /^(snappymail/)/u on my system. I don't know why seemingly no one else has run into this as I have been unable to find any GH issues related to it. For reference I am running Alpine Linux which uses the Busybox userland and musl libc.

This PR replaces the array_map callable with an anonymous function that adds the delimiter argument to preg_quote. The bad regex above is correctly translated into /^(snappymail\/)/u after applying the patch.

the-djmaze commented 2 months ago

https://www.php.net/preg_quote

The special regular expression characters are: . \ + * ? [ ^ ] $ ( ) { } = ! < > | : - # Note that / is not a special regular expression character.

So this will also work:

$files = '#^(' . \implode('|', \array_map('preg_quote', \is_array($files) ? $files : [$files])) . ')#u';