Mail: stricter checking of IMAP tags.

Only "A-Za-z0-9-._" characters now allowed (which is stricter than what
RFC 3501 requires, but expected to be enough for all known clients),
and tags shouldn't be longer than 32 characters.
This commit is contained in:
Maxim Dounin 2021-05-19 03:13:26 +03:00
parent 82840d1651
commit 4617dd64b8

View File

@ -265,6 +265,17 @@ ngx_mail_imap_parse_command(ngx_mail_session_t *s)
case LF:
s->state = sw_start;
return NGX_MAIL_PARSE_INVALID_COMMAND;
default:
if ((ch < 'A' || ch > 'Z') && (ch < 'a' || ch > 'z')
&& (ch < '0' || ch > '9') && ch != '-' && ch != '.'
&& ch != '_')
{
goto invalid;
}
if (p - s->buffer->start > 31) {
goto invalid;
}
break;
}
break;