[Web][Dovecot] imapsync: Block skipmess in custom params

data/Dockerfiles/dovecot/imapsync_runner.py

@@ -23,7 +23,7 @@ token_min_valid = 900
 # Custom params never passed, also when stored before (same list as CustomParams::BLOCKED in the web UI)
 blocked_params = {'abort', 'delete2foldersbutnot', 'delete2foldersonly', 'logdir', 'logfile', 'maxlinelengthcmd',
   'oauthrefreshcmd1', 'oauthrefreshcmd2', 'passfile1', 'passfile2', 'pidfile', 'pipemess', 'regexflag', 'regexmess',
-  'regextrans2', 'showpasswords', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'}
+  'regextrans2', 'showpasswords', 'skipmess', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'}
 # imapsync only gets these variables, not the secrets of the container environment
 job_env_keys = ('PATH', 'LANG', 'LC_ALL', 'TZ')
 # A source must not point to mailcow itself (internal Docker network), host1 is checked before each run

data/web/inc/lib/mailcow/Imapsync/Model/CustomParams.php

@@ -26,7 +26,7 @@ class CustomParams
      */
     public const BLOCKED = ['abort', 'delete2foldersbutnot', 'delete2foldersonly', 'logdir', 'logfile', 'maxlinelengthcmd',
         'oauthrefreshcmd1', 'oauthrefreshcmd2', 'passfile1', 'passfile2', 'pidfile', 'pipemess', 'regexflag', 'regexmess',
-        'regextrans2', 'showpasswords', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'];
+        'regextrans2', 'showpasswords', 'skipmess', 'tests', 'testsdebug', 'testslive', 'testslive6', 'testsunit', 'tmpdir'];
 
     private static bool $warnedOldFormat = false;
 

tests/php/Imapsync/Model/CustomParamsTest.php

@@ -142,6 +142,27 @@ class CustomParamsTest extends TestCase
         CustomParams::toJson([['o' => '--tests', 'v' => '']], $allowlist);
     }
 
+    public function testCodeExecutingOptionsAreBlocked(): void
+    {
+        // imapsync evaluates these values as Perl code (eval) or runs them as commands
+        foreach (['delete2foldersbutnot', 'delete2foldersonly', 'maxlinelengthcmd', 'oauthrefreshcmd1', 'oauthrefreshcmd2',
+            'pipemess', 'regexflag', 'regexmess', 'regextrans2', 'skipmess'] as $option) {
+            $this->assertContains($option, CustomParams::BLOCKED);
+        }
+    }
+
+    public function testRunnerBlocksTheSameOptions(): void
+    {
+        $runner = file_get_contents(__DIR__ . '/../../../../data/Dockerfiles/dovecot/imapsync_runner.py');
+        $this->assertSame(1, preg_match('/^blocked_params = \{(.*?)\}/ms', $runner, $m));
+        preg_match_all("/'([a-z0-9]+)'/", $m[1], $options);
+        $runnerBlocked = $options[1];
+        $blocked = CustomParams::BLOCKED;
+        sort($runnerBlocked);
+        sort($blocked);
+        $this->assertSame($blocked, $runnerBlocked);
+    }
+
     public function testOldWhitelistFormatIsIgnored(): void
     {
         $errorLog = ini_set('error_log', '/dev/null');