protected static function HtmlMailSystem::isShellSafe in HTML Mail 8.3

Disallows potentially unsafe shell characters.

Functionally similar to PHPMailer::isShellSafe() which resulted from CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate for this purpose.

This method should be kept in sync with PhpMail::_isShellSafe().

Parameters

string $string: The string to be validated.

Return value

bool TRUE if the string is shell-safe.

File

src/Plugin/Mail/HtmlMailSystem.php, line 471

Class

HtmlMailSystem: Modify the Drupal mail system to use HTML Mail when sending emails.

Namespace

Drupal\htmlmail\Plugin\Mail

Code

protected static function isShellSafe($string) {
  if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), [
    "'{$string}'",
    "\"{$string}\"",
  ])) {
    return FALSE;
  }
  if (preg_match('/[^a-zA-Z0-9@_\\-.]/', $string) !== 0) {
    return FALSE;
  }
  return TRUE;
}

You are here