From 47ad0af21e88fa040902c626840878dc311fc8a3 Mon Sep 17 00:00:00 2001
From: tituspijean <tituspijean@outlook.com>
Date: Sun, 24 Apr 2022 22:44:36 +0200
Subject: [PATCH] Add patch for CVE-2022-29360

---
 scripts/install                               |  7 ++++++
 scripts/upgrade                               |  7 ++++++
 .../patches/app-CVE-2022-29360.patch.template | 23 +++++++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 sources/patches/app-CVE-2022-29360.patch.template

diff --git a/scripts/install b/scripts/install
index b5059fc..9045c02 100644
--- a/scripts/install
+++ b/scripts/install
@@ -87,6 +87,13 @@ ynh_app_setting_set --app=$app --key=final_path --value=$final_path
 # Download, check integrity, uncompress and patch the source from app.src
 ynh_setup_source --dest_dir="$final_path/app"
 
+# Deploy CVE-2022-29360 patch
+version=$(ynh_app_upstream_version)
+# FIXME because we need to apply the patch manually with --binary flag
+# while we should be able to simply use the patching feature of ynh_setup_source
+ynh_add_config --template="../sources/patches/app-CVE-2022-29360.patch.template" --destination="../sources/patches/FIXMEapp-CVE-2022-29360.patch"
+patch --binary $final_path/app/rainloop/v/$version/app/libraries/MailSo/Base/HtmlUtils.php < ../sources/patches/FIXMEapp-CVE-2022-29360.patch
+
 #=================================================
 # NGINX CONFIGURATION
 #=================================================
diff --git a/scripts/upgrade b/scripts/upgrade
index 25c9a8e..ad6aaf0 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -106,6 +106,13 @@ then
 
 	# Download, check integrity, uncompress and patch the source from app.src
 	ynh_setup_source --dest_dir="$final_path/app"
+
+	# Deploy CVE-2022-29360 patch
+	version=$(ynh_app_upstream_version)
+	# FIXME because we need to apply the patch manually with --binary flag
+	# while we should be able to simply use the patching feature of ynh_setup_source
+	ynh_add_config --template="../sources/patches/app-CVE-2022-29360.patch.template" --destination="../sources/patches/FIXMEapp-CVE-2022-29360.patch"
+	patch --binary $final_path/app/rainloop/v/$version/app/libraries/MailSo/Base/HtmlUtils.php <../sources/patches/FIXMEapp-CVE-2022-29360.patch
 fi
 
 #=================================================
diff --git a/sources/patches/app-CVE-2022-29360.patch.template b/sources/patches/app-CVE-2022-29360.patch.template
new file mode 100644
index 0000000..79fceee
--- /dev/null
+++ b/sources/patches/app-CVE-2022-29360.patch.template
@@ -0,0 +1,23 @@
+diff --git a/rainloop/v/__VERSION__/app/libraries/MailSo/Base/HtmlUtils.php b/rainloop/v/__VERSION__/app/libraries/MailSo/Base/HtmlUtils.new
+index 2177627..f1e014e 100644
+--- a/rainloop/v/__VERSION__/app/libraries/MailSo/Base/HtmlUtils.php
++++ b/rainloop/v/__VERSION__/app/libraries/MailSo/Base/HtmlUtils.new
+@@ -239,7 +239,8 @@ class HtmlUtils
+ 				$oWrapHtml->setAttribute($sKey, $sValue);
+ 			}
+ 
+-			$oWrapDom = $oDom->createElement('div', '___xxx___');
++			$rand_str = base64_encode(random_bytes(32));
++			$oWrapDom = $oDom->createElement('div', $rand_str);
+ 			$oWrapDom->setAttribute('data-x-div-type', 'body');
+ 			foreach ($aBodylAttrs as $sKey => $sValue)
+ 			{
+@@ -250,7 +251,7 @@ class HtmlUtils
+ 
+ 			$sWrp = $oDom->saveHTML($oWrapHtml);
+ 
+-			$sResult = \str_replace('___xxx___', $sResult, $sWrp);
++			$sResult = \str_replace($rand_str, $sResult, $sWrp);
+ 		}
+ 
+ 		$sResult = \str_replace(\MailSo\Base\HtmlUtils::$KOS, ':', $sResult);