From 876c54b2927e48ab6900e5e6b9395742f75e840e Mon Sep 17 00:00:00 2001 From: Paul Date: Sun, 23 May 2021 12:16:40 +0100 Subject: [PATCH] harden link checker before accepting click [Retrieved from: https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431] Signed-off-by: Fabrice Fontaine [Julien: rebased patch on version 3.7.0] Signed-off-by: Julien Olivain --- src/textview.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/textview.c b/src/textview.c index e55eea9..6fbb8a1 100644 --- a/src/textview.c +++ b/src/textview.c @@ -2689,7 +2689,7 @@ static gboolean textview_uri_security_check(TextView *textview, RemoteURI *uri) gboolean retval = TRUE; if (is_uri_string(uri->uri) == FALSE) - return TRUE; + return FALSE; buffer = gtk_text_view_get_buffer(GTK_TEXT_VIEW(textview->text)); gtk_text_buffer_get_iter_at_offset(buffer, &start_iter, uri->start); @@ -2725,6 +2725,8 @@ static gboolean textview_uri_security_check(TextView *textview, RemoteURI *uri) if (aval == G_ALERTDEFAULT) retval = TRUE; } + if (strlen(uri->uri) > get_uri_len(uri->uri)) + retval = FALSE; g_free(visible_str); -- 2.45.2