Fixes ZF2016-04 vulnerability

Fixed sendmail remote code execution vulnerability.

Author: ezimuel

src/Transport/Sendmail.php

@@ -225,6 +225,16 @@ protected function prepareHeaders(Mail\Message $message)
         $headers = clone $message->getHeaders();
         $headers->removeHeader('To');
         $headers->removeHeader('Subject');
+
+        // Sanitize the From header
+        $from = $headers->get('From');
+        if ($from) {
+            foreach ($from->getAddressList() as $address) {
+                if (preg_match('/\\\"/', $address->getEmail())) {
+                    throw new Exception\RuntimeException('Potential code injection in From header');
+                }
+            }
+        }
         return $headers->toString();
     }
 

test/Transport/SendmailTest.php

@@ -10,6 +10,7 @@
 namespace ZendTest\Mail\Transport;
 
 use Zend\Mail\Message;
+use Zend\Mail\Transport\Exception\RuntimeException;
 use Zend\Mail\Transport\Sendmail;
 
 /**
@@ -133,4 +134,28 @@ public function testAssertSubjectEncoded()
         $this->transport->send($message);
         $this->assertEquals('=?UTF-8?Q?Testing=20Zend\Mail\Transport\Sendmail?=', $this->subject);
     }
+
+    public function testCodeInjectionInFromHeader()
+    {
+        $message = $this->getMessage();
+        $message->setBody('This is the text of the email.');
+        $message->setFrom('"AAA\" code injection"@domain', 'Sender\'s name');
+        $message->addTo('hacker@localhost', 'Name of recipient');
+        $message->setSubject('TestSubject');
+
+        $this->setExpectedException(RuntimeException::class);
+        $this->transport->send($message);
+    }
+
+    public function testValidEmailLocaDomainInFromHeader()
+    {
+        $message = $this->getMessage();
+        $message->setBody('This is the text of the email.');
+        $message->setFrom('"foo-bar"@domain', 'Foo Bar');
+        $message->addTo('hacker@localhost', 'Name of recipient');
+        $message->setSubject('TestSubject');
+
+        $this->transport->send($message);
+        $this->assertContains('From: Foo Bar <"foo-bar"@domain>', $this->additional_headers);
+    }
 }