From 0e0d05d5f476df9f900e4686a940b4f5dc336133 Mon Sep 17 00:00:00 2001
From: kazu <kazu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 14 Oct 2008 02:22:46 +0000
Subject: * lib/net/pop.rb: check for invalid APOP timestamp. (CVE-2007-1558)  
 [ruby-dev:36631]

* test/net/pop/test_pop.rb: ditto.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@19776 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 lib/net/pop.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'lib/net/pop.rb')

diff --git a/lib/net/pop.rb b/lib/net/pop.rb
index a8e9987236..7d234c191c 100644
--- a/lib/net/pop.rb
+++ b/lib/net/pop.rb
@@ -870,7 +870,7 @@ module Net
       @socket = sock
       @error_occured = false
       res = check_response(critical { recv_response() })
-      @apop_stamp = res.slice(/<.+>/)
+      @apop_stamp = res.slice(/<[!-~]+@[!-~]+>/)
     end
 
     attr_reader :socket
-- 
cgit v1.2.3