| Subject: | Generated cid allows to unscramble parts of the path |
Generated cid allows to unscramble parts of the path, which is a security
hole. So instead of the following:
sub cid (\%$) {
my ($self, $url)=@_;
# rfc say: don't use '/'. So I do a pack on it.
# but as string can get long, I need to revert it to have
# difference at begin of url to avoid max size of cid
# I remove scheme always same in a document.
$url = reverse(substr($url, 7));
return
reverse(split("",unpack("h".length($url),$url))).'@MIME-Lite-HTML-'.
$VERSION;
}
this should be used:
sub cid (\%$) {
my ($self, $url)=@_;
# rfc say: don't use '/'. So I do a pack on it.
# but as string can get long, I need to revert it to have
# difference at begin of url to avoid max size of cid
# I remove scheme always same in a document.
return crypt($url,'XX').'@MIME-Lite-HTML-'.
$VERSION;
}