[JAMES-3646] Review of file based components

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: master, 3.6.0
• Fix Version/s: 3.7.0
• Component/s: mailbox, MailStore & MailRepository, Queue, sieve
• Assignee: Unassigned
• Reporter: Benoit Tellier
• Created: 05/Sep/21 00:53
• Updated: 09/Dec/21 10:21
• Resolved: 03/Dec/21 07:53

Description

Running a quick audit, I realise none of James file based components validates the underlying file names. One could inject relative path to write files / read files on any location.

The affected components are:

• The file mail queue
• Maildir mailbox implementation
• Sieve file storage
• and FileMail repository

Regarding the fix:

• Enforce Sieve files to belong to the Sieve root
• Validate that created FileRepositories belong to the James root
• Drop the long deprecated FileMailQueue rather than fixing it...
• I also proposes to drop the maildir implementation - unless someone else devote himself to fix it!

Regards,

Benoit

Issue Links

• breaks: JAMES-3682 Validation/jail break detection of file url is breaking FileMailRepository initialization
• links to: GitHub Pull Request #636
• links to: GitHub Pull Request #637
• links to: GitHub Pull Request #646
• links to: GitHub Pull Request #659
• links to: GitHub Pull Request #661