You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by bt...@apache.org on 2022/03/30 03:55:43 UTC
[james-project] 04/06: JAMES-1862 STARTTLS command injection for Managesieve
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 6f0bc9a17adf7bee26e9e8753e623e6bb38ba689
Author: Benoit Tellier <bt...@linagora.com>
AuthorDate: Mon Mar 21 08:53:58 2022 +0700
JAMES-1862 STARTTLS command injection for Managesieve
---
.../managesieveserver/netty/ChannelManageSieveResponseWriter.java | 7 ++++---
.../managesieveserver/netty/ManageSieveChannelUpstreamHandler.java | 4 ++--
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ChannelManageSieveResponseWriter.java b/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ChannelManageSieveResponseWriter.java
index d068dfe..4bf4240 100644
--- a/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ChannelManageSieveResponseWriter.java
+++ b/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ChannelManageSieveResponseWriter.java
@@ -31,6 +31,7 @@ import io.netty.handler.stream.ChunkedStream;
public class ChannelManageSieveResponseWriter implements CommandDetectionSession {
private final Channel channel;
private String cumulation = null;
+ private boolean needsCommandInjectionDetection = true;
public ChannelManageSieveResponseWriter(Channel channel) {
this.channel = channel;
@@ -45,17 +46,17 @@ public class ChannelManageSieveResponseWriter implements CommandDetectionSession
@Override
public boolean needsCommandInjectionDetection() {
- return false;
+ return needsCommandInjectionDetection;
}
@Override
public void startDetectingCommandInjection() {
-
+ needsCommandInjectionDetection = true;
}
@Override
public void stopDetectingCommandInjection() {
-
+ needsCommandInjectionDetection = false;
}
public void resetCumulation() {
diff --git a/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ManageSieveChannelUpstreamHandler.java b/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ManageSieveChannelUpstreamHandler.java
index f013553..463dc60 100644
--- a/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ManageSieveChannelUpstreamHandler.java
+++ b/server/protocols/protocols-managesieve/src/main/java/org/apache/james/managesieveserver/netty/ManageSieveChannelUpstreamHandler.java
@@ -48,8 +48,7 @@ public class ManageSieveChannelUpstreamHandler extends ChannelInboundHandlerAdap
private final ManageSieveProcessor manageSieveProcessor;
private final Encryption secure;
- public ManageSieveChannelUpstreamHandler(
- ManageSieveProcessor manageSieveProcessor, Encryption secure, Logger logger) {
+ public ManageSieveChannelUpstreamHandler(ManageSieveProcessor manageSieveProcessor, Encryption secure, Logger logger) {
this.logger = logger;
this.manageSieveProcessor = manageSieveProcessor;
this.secure = secure;
@@ -76,6 +75,7 @@ public class ManageSieveChannelUpstreamHandler extends ChannelInboundHandlerAdap
turnSSLon(ctx.channel());
manageSieveSession.setSslEnabled(true);
manageSieveSession.setState(Session.State.UNAUTHENTICATED);
+ attachment.stopDetectingCommandInjection();
}
} catch (NotEnoughDataException ex) {
// Do nothing will keep the cumulation
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org