Skip to content

fix(mime-viewer): sanitize charset parameter containing full MIME type - #5

Merged
ralflang merged 1 commit into
horde:FRAMEWORK_6_0from
jcdelepine:fix/charset-content-type
Aug 5, 2026
Merged

fix(mime-viewer): sanitize charset parameter containing full MIME type#5
ralflang merged 1 commit into
horde:FRAMEWORK_6_0from
jcdelepine:fix/charset-content-type

Conversation

@jcdelepine

Copy link
Copy Markdown
Contributor

Some buggy mailers set the charset parameter to the full MIME type (e.g. charset="text/html") instead of a valid character set name, causing a fatal error when attempting to convert the character set. Fall back to UTF-8 when the charset value contains a slash, which is a reliable indicator of a misplaced MIME type.

Some buggy mailers set the charset to an invalid value
(e.g. charset="text/html") instead of a valid character set name,
causing a fatal error when attempting to convert the character set.
Fall back to UTF-8 when the charset value is unambiguously invalid
(i.e. does not match [a-zA-Z0-9_-]).
@jcdelepine
jcdelepine force-pushed the fix/charset-content-type branch from 92ac1ec to 23d3f11 Compare August 3, 2026 12:51
@ralflang

ralflang commented Aug 5, 2026

Copy link
Copy Markdown
Member

Thank you. Do you have a sample of such a buggy mailer software or created mail so I can add a unit test?

@ralflang
ralflang merged commit c7dd74e into horde:FRAMEWORK_6_0 Aug 5, 2026
1 check passed
@jcdelepine

Copy link
Copy Markdown
Contributor Author

mail.eml

As you can see, this mailer uses

Content-Type: text/html; charset="text/html"

And horde said :

2026-08-03T11:44:38+02:00 DEBUG: HORDE [imp] Unable to convert character set from "text/html" to "utf-8". Attempted methods: iconv, mbstring, UConverter. Failures: iconv failed or does not support charset; mbstring: mb_convert_encoding(): Argument #3 ($from_encoding) contains invalid encoding "text/html"; UConverter returned empty/false result. [pid 941789 on line 232 of "/var/www/horde-git/horde/Util/src/HordeString.php"]
2026-08-03T11:44:38+02:00 DEBUG: HORDE  1. require_once() /var/www/horde/web/horde/services/ajax.php:3
 2. Horde\Core\Ajax\Application->doAction() /var/www/horde-git/horde/base/services/ajax.php:65
 3. call_user_func() /var/www/horde-git/horde/Core/src/Ajax/Application.php:210
 4. IMP_Ajax_Application_Handler_Common->showMessage()
 5. IMP_Ajax_Queue->message() /var/www/horde-git/horde/imp/lib/Ajax/Application/Handler/Common.php:719
 6. IMP_Contents_Message->showMessage() /var/www/horde-git/horde/imp/lib/Ajax/Queue.php:462
 7. IMP_Contents_Message->getInlineOutput() /var/www/horde-git/horde/imp/lib/Contents/Message.php:176
 8. IMP_Contents_Message->_getInlineOutput() /var/www/horde-git/horde/imp/lib/Contents/Message.php:337
 9. IMP_Contents->renderMIMEPart() /var/www/horde-git/horde/imp/lib/Contents/Message.php:595
10. Horde_Mime_Viewer_Base->render() /var/www/horde-git/horde/imp/lib/Contents.php:665
11. IMP_Mime_Viewer_Html->_renderInline() /var/www/horde-git/horde/Mime_Viewer/lib/Horde/Mime/Viewer/Base.php:159
12. IMP_Mime_Viewer_Html->_IMPrender() /var/www/horde-git/horde/imp/lib/Mime/Viewer/Html.php:76
13. Horde_Mime_Viewer_Html->_cleanHTML() /var/www/horde-git/horde/imp/lib/Mime/Viewer/Html.php:160
14. Horde_Mime_Viewer_Base->_textFilter() /var/www/horde-git/horde/Mime_Viewer/lib/Horde/Mime/Viewer/Html.php:152
15. Horde_Core_Factory_TextFilter->filter() /var/www/horde-git/horde/Mime_Viewer/lib/Horde/Mime/Viewer/Base.php:439
16. Horde_Text_Filter::filter() /var/www/horde-git/horde/Core/lib/Horde/Core/Factory/TextFilter.php:71
17. Horde_Text_Filter_Xss->postProcess() /var/www/horde-git/horde/Text_Filter/lib/Horde/Text/Filter.php:111
18. Horde\Util\Domhtml->__construct() /var/www/horde-git/horde/Text_Filter/lib/Horde/Text/Filter/Xss.php:76
19. Horde\Util\HordeString::convertCharset() /var/www/horde-git/horde/Util/src/Domhtml.php:99
20. Horde\Util\HordeString::_convertCharset() /var/www/horde-git/horde/Util/src/HordeString.php:116

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants