Deep clean invalid UTF8 bytes from headers hash

thoughtbot · Jul 9, 2015 · 96336c3 · 96336c3
1 parent c49387f
commit 96336c3
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 4 deletions.
diff --git a/lib/griddler/email.rb b/lib/griddler/email.rb
@@ -50,10 +50,7 @@ def extract_body
 
     def extract_headers
       if params[:headers].is_a?(Hash)
-        params[:headers].inject({}) do |header_hash, (header_name, header_value)|
-          header_hash[header_name] = clean_invalid_utf8_bytes(header_value)
-          header_hash
-        end
+        deep_clean_invalid_utf8_bytes(params[:headers])
       else
         EmailParser.extract_headers(clean_invalid_utf8_bytes(params[:headers]))
       end
@@ -79,6 +76,19 @@ def clean_html(html)
       cleaned_html
     end
 
+    def deep_clean_invalid_utf8_bytes(o)
+      case o
+      when Hash
+        o.inject({}) { |h, (k, v)| h[k] = deep_clean_invalid_utf8_bytes(v); h }
+      when Array
+        o.map { |v| deep_clean_invalid_utf8_bytes(v) }
+      when String
+        clean_invalid_utf8_bytes(o)
+      else
+        o
+      end
+    end
+
     def clean_invalid_utf8_bytes(text)
       if text && !text.valid_encoding?
         text.force_encoding('ISO-8859-1').encode('UTF-8')

diff --git a/spec/griddler/email_spec.rb b/spec/griddler/email_spec.rb
@@ -476,6 +476,15 @@ def email_with_params(params)
     expect(headers[header_name]).to eq "invalid utf-8 bytes are ÀÁõúþÿ."
   end
 
+  it 'deeply cleans invalid UTF-8 bytes from a hash when it is submitted' do
+    header_name = 'Arbitrary-Header'
+    header_value = "invalid utf-8 bytes are \xc0\xc1\xf5\xfa\xfe\xff."
+    header = { header_name => { "a" => [header_value] } }
+    headers = header_from_email(header)
+
+    expect(headers[header_name]).to eq({ "a" => ["invalid utf-8 bytes are ÀÁõúþÿ."] })
+  end
+
   it 'handles no matched headers' do
     headers = header_from_email('')
     expect(headers).to eq({})