diff --git a/typo3/sysext/core/Classes/Utility/GeneralUtility.php b/typo3/sysext/core/Classes/Utility/GeneralUtility.php index ef62095c5699471dd249ae94897633aa2f4da638..8e482570fff6b7ecba09f5e03806cbbcb454cb81 100644 --- a/typo3/sysext/core/Classes/Utility/GeneralUtility.php +++ b/typo3/sysext/core/Classes/Utility/GeneralUtility.php @@ -914,7 +914,11 @@ class GeneralUtility $domain = substr($email, $atPosition + 1); $user = substr($email, 0, $atPosition); if (!preg_match('/^[a-z0-9.\\-]*$/i', $domain)) { - $domain = self::idnaEncode($domain); + try { + $domain = self::idnaEncode($domain); + } catch (\InvalidArgumentException $exception) { + return false; + } } return filter_var($user . '@' . $domain, FILTER_VALIDATE_EMAIL) !== false; } @@ -1018,7 +1022,11 @@ class GeneralUtility return false; } if (isset($parsedUrl['host']) && !preg_match('/^[a-z0-9.\\-]*$/i', $parsedUrl['host'])) { - $parsedUrl['host'] = self::idnaEncode($parsedUrl['host']); + try { + $parsedUrl['host'] = self::idnaEncode($parsedUrl['host']); + } catch (\InvalidArgumentException $exception) { + return false; + } } return filter_var(HttpUtility::buildUrl($parsedUrl), FILTER_VALIDATE_URL) !== false; } diff --git a/typo3/sysext/core/Tests/Unit/Utility/GeneralUtilityTest.php b/typo3/sysext/core/Tests/Unit/Utility/GeneralUtilityTest.php index 7534fa71d0fb0be7f8e797c44751cb7a9e5a3c78..9b35773d1c239bf2e26c6c049f0bab8d9627a4c4 100644 --- a/typo3/sysext/core/Tests/Unit/Utility/GeneralUtilityTest.php +++ b/typo3/sysext/core/Tests/Unit/Utility/GeneralUtilityTest.php @@ -981,7 +981,8 @@ class GeneralUtilityTest extends \TYPO3\TestingFramework\Core\Unit\UnitTestCase 'trailing carriage return' => ['test@example.com' . CR], 'trailing linefeed' => ['test@example.com' . LF], 'trailing carriage return linefeed' => ['test@example.com' . CRLF], - 'trailing tab' => ['test@example.com' . TAB] + 'trailing tab' => ['test@example.com' . TAB], + 'prohibited input characters' => ['“mailto:test@example.comâ€'], ]; } @@ -1902,6 +1903,7 @@ class GeneralUtilityTest extends \TYPO3\TestingFramework\Core\Unit\UnitTestCase 'string array()' => ['array()'], 'random string' => ['qwe'], 'http directory umlauts' => ['http://www.oebb.at/äöü/'], + 'prohibited input characters' => ['https://{$unresolved_constant}'], ]; }