Bug #41614 for Email-MIME: infinite recursion in remove_attachments

Perl version: v5.8.8 OS vendor and version: Red Hat Enterprise Linux 5.2 (linux 2.6.18-92.el5) x86_64 Problem: The remove_attachments function in SYNOPSIS falls into infinite recursion when content-type of a part is 'message'. How reproduceable: Always Steps to reproduce the problem: Place the attached files code1.pl and sample-mail.txt in a same directory and run code1.pl. Proposed fix: The attached patch, patch.txt, adds an if clause for content_type == message, when the function remove_attachments recurses into $part->body. Though it's a little bit complicated as a sample, it also demonstrates the use of the body_set method in addition to parts_set.

#!/usr/bin/perl use Data::Dumper; use Email::MIME; use Email::MIME::Modifier; #use Email::MIME::Attachment::Stripper; my $msgfile = './sample-mail.txt'; open HANDLE, $msgfile or die "cannot open : $!"; while(my $str = <HANDLE>) { $mail .= $str; } close HANDLE; my $email = Email::MIME->new($mail); # print the mime structure (for debug) #my $description = $email->debug_structure; #print $description; remove_attachments($email); @parts = $email->parts; print $parts[0]->body; sub remove_attachments { # borrowed this from the Email:MIME:Modifier example my $email = shift; my @keep; foreach my $part ( $email->parts ) { push @keep, $part unless $part->header('Content-Disposition') =~ /^attachment/; remove_attachments($part) if $part->content_type =~ /^(?:multipart|message)/; } $email->parts_set( \@keep ); }

From: user1@example.com To: user2@example.com Subject: =?ISO-2022-JP?B?GyRCIVo9RU1XIVslJiUkJWslOSVBJSclQyUvGyhC?= =?ISO-2022-JP?B?GyRCJE43azJMGyhC?= Date: Tue, 07 Oct 2008 13:18:13 +0900 Message-ID: <20081007131813.AB8FKC.025170.00000000.proscan@vcgw5w.ymc. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----AB8FKC.025170.00000000" X-Mailer: ProScan Mail scanner X-ProScan-Version: 6.0.3.8 X-Priority: 3 (normal) This is a multi-part message in MIME format. ------AB8FKC.025170.00000000 Content-Type: text/plain;charset="ISO-2022-JP" Content-Transfer-Encoding: 7bit -------------------------------------------------------------------- !Z=EMW![%&%$%k%9%A%'%C%/$N7k2L (!w#Y#M#C%&%$%k%96n=|%5!<%S%9) -------------------------------------------------------------------- 0J2<$N%a!<%k$O#1$D0J>e$N%&%$%k%9$K46@w$K$7$F$$$^$9!# %a!<%k>pJs ==================== BjL> : Fraud Transactions Aw?.<T : user3@example.com <u?.<T : user2@example.com Aw?.F| : 2008/10/07 13:18:07 Message-ID: <01c92801$687ef980$97778048@telsoft> %&%$%k%9>pJs ==================== Statement.zip(application/zip) infected HIDDENEXT/Crypted %X%C%@>pJs ==================== Received: from cpe-72-128-119-151.wi.res.rr.com (72.128.119.151) by vcgw5w.ymc.ne.jp with SMTP; 7 Oct 2008 13:18:10 +0900 Received: from [72.128.119.151] by ussmtp1.quark.com; Mon, 6 Oct 2008 22:18:07 -0600 From: "Armando Hand" <user3@example.com> To: <user4@example.com> Subject: Fraud Transactions Date: Mon, 6 Oct 2008 22:18:07 -0600 Message-ID: <01c92801$687ef980$97778048@telsoft> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_000E_01C92801.687EF980" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal -------------------------------------------------------------------- $3$N%a!<%k$O!w#Y#M#C%&%$%k%96n=|%5!<%P!<$+$i<+F0Aw?.$7$F$*$j$^$9!# %&%$%k%9%A%'%C%/$N7k2L!"%a!<%kAw?.<T$N%3%s%T%e!<%?$,%&%$%k%9$K46@w$7 $F$$$k2DG=@-$,$"$j$^$9!# $J$*!":G6a$N%&%$%k%9$NBgH>$OAw?.<T$N%"%I%l%9$r56Au$7Aw?.$7$F$$$k$?$a!" Aw?.<T$K$ODLCN$r9T$C$F$*$j$^$;$s!# BjL>!&Aw?.<T$J$I$+$i=EMW$J%a!<%k$@$H9M$($i$l$k>l9g$K$O!"Aw?.<T$K%a!< %k$NFbMF$r$43NG'$$$?$@$-$^$9$h$&!"$*4j$$$$$?$7$^$9!# ------AB8FKC.025170.00000000 Content-Type: message/rfc822 Received: from cpe-72-128-119-151.wi.res.rr.com (72.128.119.151) by vcgw5w.ymc.ne.jp with SMTP; 7 Oct 2008 13:18:10 +0900 Received: from [72.128.119.151] by ussmtp1.quark.com; Mon, 6 Oct 2008 22:18:07 -0600 From: "Armando Hand" <user3@example.com> To: <user4@example.com> Subject: Fraud Transactions Date: Mon, 6 Oct 2008 22:18:07 -0600 Message-ID: <01c92801$687ef980$97778048@telsoft> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_000E_01C92801.687EF980" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C92801.687EF980 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Greating and felications Dear Credit Card Holder: Please be aware that a credit card fraud involving your credit card has been registered by our security department. For your information, we are sending you the account statement that includes all transactions made with your credit card from 01.09.2008 through 03.09.2008. Please take a note of the last three transactions on the list, which have been recognized as fraudulent. We highly recommend you to inform us of the transactions you have made personally. Thus, you will help us and yourself to resolve this issue as soon as possible. An MS Word document containing your account statement in is enclosed in the archive attached to this message. Good-bye until next time Armando Hand Manager of Credit Card Fraud Defense ------=_NextPart_000_000E_01C92801.687EF980-- ------AB8FKC.025170.00000000--

diff --git a/README b/README index 8342c6d..60434de 100644 --- a/README +++ b/README @@ -14,8 +14,13 @@ SYNOPSIS foreach my $part ( $email->parts ) { push @keep, $part unless $part->header('Content-Disposition') =~ /^attachment/; - remove_attachments($part) - if $part->content_type =~ /^(?:multipart|message)/; + if ( $part->content_type =~ /^multipart/ ) { + remove_attachments($part) + } elsif ( $part->content_type =~ /^message/ ) { + my $encap = Email::MIME->new($part->body); + remove_attachments($encap); + $part->body_set($encap->body_raw); + } } $email->parts_set( \@keep ); } diff --git a/lib/Email/MIME/Modifier.pm b/lib/Email/MIME/Modifier.pm index 12adae2..39af488 100644 --- a/lib/Email/MIME/Modifier.pm +++ b/lib/Email/MIME/Modifier.pm @@ -37,8 +37,13 @@ version 1.442 foreach my $part ( $email->parts ) { push @keep, $part unless $part->header('Content-Disposition') =~ /^attachment/; - remove_attachments($part) - if $part->content_type =~ /^(?:multipart|message)/; + if ( $part->content_type =~ /^multipart/ ) { + remove_attachments($part) + } elsif ( $part->content_type =~ /^message/ ) { + my $encap = Email::MIME->new($part->body); + remove_attachments($encap); + $part->body_set($encap->body_raw); + } } $email->parts_set( \@keep ); }