From b3e5f7a8c699a7ad57b259658524534fef265f42 Mon Sep 17 00:00:00 2001 From: David Taylor Date: Wed, 24 Jul 2019 13:45:02 +0100 Subject: [PATCH] SECURITY: Sanitize email id for use as mutex key --- lib/email/receiver.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/email/receiver.rb b/lib/email/receiver.rb index 42615bebf33..18452eb067b 100644 --- a/lib/email/receiver.rb +++ b/lib/email/receiver.rb @@ -67,7 +67,8 @@ module Email def process! return if is_blacklisted? - DistributedMutex.synchronize(@message_id) do + id_hash = Digest::SHA1.hexdigest(@message_id) + DistributedMutex.synchronize("process_email_#{id_hash}") do begin return if IncomingEmail.exists?(message_id: @message_id) ensure_valid_address_lists