From 2b14c8c6f3b2c7a39e6fc92f27160ddc92adfabb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Wed, 8 Jan 2025 17:35:27 +0100 Subject: [PATCH] Sanitize attachment filename for incoming document from email When creating document incoming from email's attachments, the filename value must be sanitized as there is no control on the data. Closes #13801 (grafted from 118ace742c074540582f0ff784ccd9edc8926f98) --HG-- branch : 7.0 --- modules/document_incoming/document.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/document_incoming/document.py b/modules/document_incoming/document.py index 5099485b01..5bf678a104 100644 --- a/modules/document_incoming/document.py +++ b/modules/document_incoming/document.py @@ -181,14 +181,17 @@ class Incoming(DeactivableMixin, Workflow, ModelSQL, ModelView): @classmethod def from_inbound_email(cls, email_, rule): + def sanitize_name(value): + for forbidden_char in cls.name.forbidden_chars: + value = value.replace(forbidden_char, ' ') + return value + message = email_.as_dict() active = not message.get('attachments') data = message.get('text', message.get('html')) if isinstance(data, str): data = data.encode() - name = message.get('subject') or 'No Subject' - for forbidden_char in cls.name.forbidden_chars: - name = name.replace(forbidden_char, ' ') + name = sanitize_name(message.get('subject') or 'No Subject') document = cls( active=active, name=name, @@ -200,7 +203,7 @@ class Incoming(DeactivableMixin, Workflow, ModelSQL, ModelView): children = [] for attachment in message.get('attachments', []): child = cls( - name=attachment['filename'] or 'data.bin', + name=sanitize_name(attachment['filename'] or 'data.bin'), company=rule.document_incoming_company, data=attachment['data'], type=rule.document_incoming_type,