mirror of
https://github.com/ellite/Wallos.git
synced 2026-07-31 02:05:54 -04:00
800241a265
Raw CRLF in subscription name/notes/url passes through validate() untouched (it only escapes HTML metacharacters) and was interpolated directly into .ics VEVENT properties, letting an unescaped newline terminate the current property and inject arbitrary calendar events. Adds includes/ical_helper.php::icalEscape() (RFC 5545 value escaping) and applies it to every user-controlled value embedded in both iCal export endpoints, rather than stripping newlines in the shared validate() sanitizer (which would break legitimate multi-line notes used elsewhere in the app).
24 lines
829 B
PHP
24 lines
829 B
PHP
<?php
|
|
|
|
/**
|
|
* Escapes a value for safe embedding in an iCalendar (RFC 5545) property value.
|
|
*
|
|
* Backslash must be escaped first, before the other substitutions introduce
|
|
* new backslashes. Raw CRLF/LF are converted to a literal two-character
|
|
* "\n" escape sequence — never leave a real newline in the output, since
|
|
* iCalendar treats CRLF as a property delimiter: an unescaped newline lets
|
|
* user-supplied text (e.g. a subscription name or notes) terminate the
|
|
* current property and inject arbitrary calendar content (CWE-93).
|
|
*/
|
|
function icalEscape($value)
|
|
{
|
|
$value = (string) $value;
|
|
$value = str_replace('\\', '\\\\', $value);
|
|
$value = str_replace(["\r\n", "\r", "\n"], '\\n', $value);
|
|
$value = str_replace(',', '\\,', $value);
|
|
$value = str_replace(';', '\\;', $value);
|
|
return $value;
|
|
}
|
|
|
|
?>
|