From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Thu, 6 Aug 2020 11:10:50 +0000 (+0300)
Subject: auth: Escape exported session ID string in protocol replies
X-Git-Tag: 2.3.13~296
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4d46d3e5cffc85744ffdcb25544a337efaa0f8da;p=thirdparty%2Fdovecot%2Fcore.git

auth: Escape exported session ID string in protocol replies

Session ID is normally coming only from trusted sources, so the lack of
escaping shouldn't have mattered too much.
---

diff --git a/src/auth/auth-request-fields.c b/src/auth/auth-request-fields.c
index a35347b10e..182a40ce74 100644
--- a/src/auth/auth-request-fields.c
+++ b/src/auth/auth-request-fields.c
@@ -94,8 +94,10 @@ void auth_request_export(struct auth_request *request, string_t *dest)
 		str_append(dest, "\tlocal_name=");
 		str_append_tabescaped(dest, fields->local_name);
 	}
-	if (fields->session_id != NULL)
-		str_printfa(dest, "\tsession=%s", fields->session_id);
+	if (fields->session_id != NULL) {
+		str_append(dest, "\tsession=");
+		str_append_tabescaped(dest, fields->session_id);
+	}
 	if (event_want_debug(request->event))
 		str_append(dest, "\tdebug");
 	switch (fields->secured) {