Handle too long dates passed to DateTime.parse #1469
Conversation
lib/mail/fields/common_date_field.rb
Outdated
| def with_invalid_date_time_error_handling(&block) | ||
| yield | ||
| rescue ArgumentError => e | ||
| raise unless e.message =~ /\A(invalid date|string length \(\d+\) exceeds the limit \d+)\z/ |
There was a problem hiding this comment.
Perhaps this should live in Mail::Utilities so it's used from here and from ReceivedElement.
There was a problem hiding this comment.
Yes, please move it into utilities.
lib/mail/fields/common_date_field.rb
Outdated
| def with_invalid_date_time_error_handling(&block) | ||
| yield | ||
| rescue ArgumentError => e | ||
| raise unless e.message =~ /\A(invalid date|string length \(\d+\) exceeds the limit \d+)\z/ |
There was a problem hiding this comment.
Yes, please move it into utilities.
| ::DateTime.parse("#{received.date} #{received.time}") | ||
| rescue ArgumentError => e | ||
| raise e unless e.message == 'invalid date' | ||
| raise unless e.message =~ /\A(invalid date|string length \(\d+\) exceeds the limit \d+)\z/ |
There was a problem hiding this comment.
Let's call the utility method you will create. One place to keep this up to date makes sense.
|
Thanks a lot for the review, @mikel! I'll get these changes implemented this week, I hope. |
Since Ruby 3.0.3, this method raises an ArgumentError with a different message from the invalid date message, as mitigation for CVE-2021-41817. https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ Example: ArgumentError: string length (150) exceeds the limit 128 In this case we should just return nil, like when the date itself is invalid.
|
Implemented the changes requested 😊 |
|
Unfortunately, that is still an issue in 2024 with Mail 2.8.1 on 3.3.0. That exception also breaks the POP functionality, as it crashes without option to rescue the individual mail: Any chance, this PR gets merged? |
|
This is still an issue on the current master branch d1d65b3. A long date field will crash the mail gem. I'm working around it with a monkeypatch like this: require 'mail/fields/common_date_field' # must require this before overriding the method below
module Mail
class CommonDateField < NamedStructuredField
def initialize(value = nil, charset = nil)
value = value && value[..127] # fix bug with long date fields, see https://github.com/mikel/mail/pull/1469
super self.class.normalize_datetime(value), charset
end
end
end |
4 participants
Since Ruby 3.0.3, this method raises an
ArgumentErrorwith a different message from the invalid date message, as mitigation for CVE-2021-41817.This PR handles this error to return
nil, just like when the date is invalid.