Harden email-address class against multiple mailto-uri's (seen in the…

… wild in eduGAIN)
simplesamlphp · Apr 9, 2024 · 011ff8f · 011ff8f
1 parent 7b40b5d
commit 011ff8f
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 3 deletions.
diff --git a/src/SAML2/XML/md/EmailAddress.php b/src/SAML2/XML/md/EmailAddress.php
@@ -56,7 +56,7 @@ protected function validateContent(string $content): void
  */
  protected function sanitizeContent(string $content): string
  {
- return trim(preg_replace('/^mailto:/i', '', $content));
+ return trim(preg_replace('/^(mailto:)+/i', '', $content));
  }
 
 

diff --git a/tests/SAML2/XML/md/EmailAddressTest.php b/tests/SAML2/XML/md/EmailAddressTest.php
@@ -54,11 +54,11 @@ public static function setUpBeforeClass(): void
  */
  public function testMarshalling(): void
  {
- $name = new EmailAddress('john.doe@example.org');
+ $email = new EmailAddress('john.doe@example.org');
 
  $this->assertEquals(
  self::$xmlRepresentation->saveXML(self::$xmlRepresentation->documentElement),
- strval($name),
+ strval($email),
  );
  }
 
@@ -89,4 +89,17 @@ public function testUnmarshallingWithInvalidEmail(): void
 
  EmailAddress::fromXML($document->documentElement);
  }
+
+
+ /**
+ * Test that creating an EmailAddress from XML succeeds when multiple mailto: prefixes are in place.
+ */
+ public function testUnmarshallingWithMultipleMailtoUri(): void
+ {
+ $document = clone self::$xmlRepresentation;
+ $document->documentElement->textContent = 'mailto:mailto:mailto:john.doe@example.org';
+
+ $email = EmailAddress::fromXML($document->documentElement);
+ $this->assertEquals('mailto:john.doe@example.org', $email->getContent());
+ }
 }