From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: X-Spam-Status: No, score=-4.6 required=3.0 tests=ALL_TRUSTED,AWL,BAYES_00, URIBL_BLOCKED shortcircuit=no autolearn=unavailable autolearn_force=no version=3.4.0 Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id BD76F1F955; Sat, 21 May 2016 04:43:48 +0000 (UTC) Date: Sat, 21 May 2016 04:43:48 +0000 From: Eric Wong To: meta@public-inbox.org Subject: [PATCH 4/1] unsubscribe: prevent decrypt from showing random crap Message-ID: <20160521044348.GA22871@dcvr.yhbt.net> References: <20160521030317.24152-1-e@80x24.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160521030317.24152-1-e@80x24.org> List-Id: Wow, I don't know crypto at all. --- Hopefully this isn't exploitable somehow... Gah :x lib/PublicInbox/Unsubscribe.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/PublicInbox/Unsubscribe.pm b/lib/PublicInbox/Unsubscribe.pm index 4ccdb7e..97ff97f 100644 --- a/lib/PublicInbox/Unsubscribe.pm +++ b/lib/PublicInbox/Unsubscribe.pm @@ -77,7 +77,7 @@ sub _user_list_addr { 'Missing mailing list name in path component'); } my $user = eval { $self->{cipher}->decrypt(decode_base64url($u)) }; - if (!defined $user || $user eq '') { + if (!defined $user || index($user, '@') <= 1) { my $err = quotemeta($@); my $errors = $env->{'psgi.errors'}; $errors->print("error decrypting: $u\n");