Merge branch 'main' into fix-sqlcipher-native-lib-load

app/src/test/kotlin/org/libremail/mail/GraphSenderTest.kt

@@ -127,4 +127,21 @@ class GraphSenderTest {
             image.delete()
         }
     }
+
+    @Test
+    fun `an inline image contentId is stripped of control characters in the payload`() {
+        val image = File.createTempFile("graph-inline", ".png").apply { writeText("PNGDATA") }
+        try {
+            val message = message(to = "a@x.com").copy(bodyHtml = "<p><img src=\"cid:logo@libremail\"></p>")
+            // A crafted content id with CR/LF and a control char; only the printable text must remain.
+            val inline = SendableAttachment(image, contentId = "logo@libremail\r\nevil", isInline = true)
+            val contentId = JSONObject(buildSendMailPayload(message, listOf(inline)))
+                .getJSONObject("message").getJSONArray("attachments").getJSONObject(0)
+                .getString("contentId")
+            assertEquals("logo@libremailevil", contentId)
+            assertFalse('\r' in contentId || '\n' in contentId, "contentId=$contentId")
+        } finally {
+            image.delete()
+        }
+    }
 }

app/src/test/kotlin/org/libremail/mail/SmtpSenderTest.kt

@@ -4,6 +4,8 @@ package org.libremail.mail
 import com.icegreen.greenmail.util.GreenMail
 import com.icegreen.greenmail.util.GreenMailUtil
 import com.icegreen.greenmail.util.ServerSetupTest
+import jakarta.mail.Multipart
+import jakarta.mail.Part
 import kotlinx.coroutines.test.runTest
 import org.junit.After
 import org.junit.Before
@@ -13,6 +15,7 @@ import org.libremail.domain.model.OutgoingMessage
 import org.libremail.domain.model.SmtpParams
 import java.io.File
 import kotlin.test.assertEquals
+import kotlin.test.assertFalse
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
 
@@ -166,6 +169,62 @@ class SmtpSenderTest {
         image.delete()
     }
 
+    @Test
+    fun `a Content-ID carrying CRLF cannot inject a MIME header line`() = runTest {
+        val image = File.createTempFile("libremail-inline", ".png").apply { writeText("PNGDATA") }
+        val params = SmtpParams(
+            host = "127.0.0.1",
+            port = greenMail.smtp.port,
+            security = MailSecurity.NONE,
+            username = "sender@example.org",
+            secret = "secret",
+            useXoauth2 = false,
+        )
+
+        sender.send(
+            params = params,
+            from = "sender@example.org",
+            message = OutgoingMessage(
+                accountId = "x",
+                to = "bob@example.org",
+                subject = "Inline injection",
+                body = "See image",
+                bodyHtml = "<p>See <img src=\"cid:logo@libremail\"></p>",
+            ),
+            // A crafted content id that, unsanitized, would break out of the Content-ID header and add
+            // its own `X-Injected` header line to the inline part.
+            attachments = listOf(
+                SendableAttachment(image, contentId = "logo@libremail\r\nX-Injected: evil", isInline = true),
+            ),
+        )
+
+        greenMail.waitForIncomingEmail(1)
+        val received = greenMail.receivedMessages.single()
+        // The CR/LF is stripped, so the crafted text never becomes its own header on any MIME part...
+        assertFalse(hasHeaderAnywhere(received, "X-Injected"), "Content-ID CR/LF must not inject a header")
+        // ...and the Content-ID that is emitted stays on a single line.
+        val cid = contentIdAnywhere(received)
+        assertTrue(cid != null && '\r' !in cid && '\n' !in cid, "Content-ID must be a single line: $cid")
+        image.delete()
+    }
+
+    /** True if [part] or any nested MIME part carries a header named [name]. */
+    private fun hasHeaderAnywhere(part: Part, name: String): Boolean {
+        if (!part.getHeader(name).isNullOrEmpty()) return true
+        val content = runCatching { part.content }.getOrNull()
+        return content is Multipart && (0 until content.count).any { hasHeaderAnywhere(content.getBodyPart(it), name) }
+    }
+
+    /** The first `Content-ID` header found on [part] or any nested MIME part, or null. */
+    private fun contentIdAnywhere(part: Part): String? {
+        part.getHeader("Content-ID")?.firstOrNull()?.let { return it }
+        val content = runCatching { part.content }.getOrNull()
+        if (content is Multipart) {
+            for (i in 0 until content.count) contentIdAnywhere(content.getBodyPart(i))?.let { return it }
+        }
+        return null
+    }
+
     @Test
     fun `send delivers a message with an attachment`() = runTest {
         val file = File.createTempFile("libremail-report", ".txt").apply { writeText("quarterly numbers") }

app/src/test/kotlin/org/libremail/richtext/RichTextHtmlTest.kt

@@ -254,6 +254,40 @@ class RichTextHtmlTest {
         assertRoundTrips(content)
     }
 
+    @Test
+    fun `an unsafe inline font-family value is dropped instead of injected raw (issue 205)`() {
+        val content = RichTextContent(
+            text = "x",
+            spans = listOf(
+                RichSpan(0, 1, RichStyle.FontFamily("Arial; color:red")),
+                RichSpan(0, 1, RichStyle.Bold),
+            ),
+        )
+        val html = RichTextHtml.toHtml(content)
+        // The smuggled sibling declaration must never reach the emitted style attribute...
+        assertFalse(html.contains("color:red"), html)
+        assertFalse(html.contains("Arial; color:red"), html)
+        assertFalse(html.contains("font-family"), html)
+        // ...but the run's other styling is unaffected.
+        assertTrue(html.contains("<b>x</b>"), html)
+    }
+
+    @Test
+    fun `an unsafe base-style font-family is dropped from the wrapper (issue 205)`() {
+        val content = RichTextContent("hi", baseStyle = RichBaseStyle(fontCss = "Arial: red;}", fontSizePt = 12))
+        val html = RichTextHtml.toHtml(content)
+        assertFalse(html.contains("font-family"), html)
+        // The safe font-size declaration in the same wrapper still emits.
+        assertTrue(html.contains("font-size:12pt"), html)
+    }
+
+    @Test
+    fun `a registry font stack with quotes and commas still emits its font-family (issue 205)`() {
+        // The bundled FontRegistry stacks are all within the safe set, so built-in fonts are unaffected.
+        val content = RichTextContent("x", spans = listOf(RichSpan(0, 1, RichStyle.FontFamily("'Inter', sans-serif"))))
+        assertTrue(RichTextHtml.toHtml(content).contains("font-family:'Inter', sans-serif"))
+    }
+
     @Test
     fun `base style wrapper adds no stray text or newlines`() {
         val restored = RichTextHtml.fromHtml("<div style=\"font-size:12pt\"><p>a<br>b</p></div>")