1From ac286a71ed78429e16c612161251b9ea90ccd431 Mon Sep 17 00:00:00 2001
2From: Paul <paul@claws-mail.org>
3Date: Sun, 23 May 2021 12:16:40 +0100
4Subject: [PATCH] harden link checker before accepting click
5
6[Retrieved from:
7https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431]
8Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
9---
10 src/textview.c | 4 +++-
11 1 file changed, 3 insertions(+), 1 deletion(-)
12
13diff --git a/src/textview.c b/src/textview.c
14index 62ad46eaf..3cdf5d911 100644
15--- a/src/textview.c
16+++ b/src/textview.c
17@@ -2885,7 +2885,7 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
18 	gboolean retval = TRUE;
19
20 	if (is_uri_string(uri->uri) == FALSE)
21-		return TRUE;
22+		return FALSE;
23
24 	visible_str = textview_get_visible_uri(textview, uri);
25 	if (visible_str == NULL)
26@@ -2922,6 +2922,8 @@ gboolean textview_uri_security_check(TextView *textview, ClickableText *uri)
27 		if (aval == G_ALERTALTERNATE)
28 			retval = TRUE;
29 	}
30+	if (strlen(uri->uri) > get_uri_len(uri->uri))
31+		retval = FALSE;
32
33 	g_free(visible_str);
34
35--
362.25.1
37
38