ZipDownload: unsafe Windows path separator in attachment filenames

Prerequisites

• I have searched for duplicate or closed issues
• I can recreate the issue with all plugins disabled

Describe the issue

An email sender controls an attachment filename. The zipdownload plugin places those filenames inside generated ZIP archives.

The Current code in plugins/zipdownload/zipdownload.php around line 378:

` private function _convert_filename($str) { $str = strtr($str, [':' => '', '/' => '-']);

return rcube_charset::convert($str, RCUBE_CHARSET, $this->charset);

} ` It strips / but but does not strip Windows' directory separator ().

That means an incoming attachment could have a name conceptually resembling: ....\something.exe and the plugin could preserve that name inside the generated ZIP. Whether it actually escapes the destination directory depends on the ZIP extraction software, but generated archives should never contain user-controlled relative paths in the first place.

In plugins/zipdownload/zipdownload.php:

Replace: ` private function _convert_filename($str) { $str = strtr($str, [':' => '', '/' => '-']);

return rcube_charset::convert($str, RCUBE_CHARSET, $this->charset);

} ` with:

` private function _convert_filename($str) { // Normalize Windows and Unix path separators first. $str = str_replace('\', '/', $str);

// Never allow an attachment-provided directory structure inside the ZIP.
$str = basename($str);

// Remove control characters and characters problematic on Windows.
$str = preg_replace('/[\x00-\x1F\x7F]+/u', ' ', $str);
$str = strtr($str, [
    ':' => '',
    '/' => '-',
    '<' => '',
    '>' => '',
    '"' => '',
    '|' => '',
    '?' => '',
    '*' => '',
]);

// Windows also treats trailing spaces and dots specially.
$str = trim($str, " .\t\r\n\0\x0B");

if ($str === '' || $str === '.' || $str === '..') {
    $str = 'attachment';
}

return rcube_charset::convert($str, RCUBE_CHARSET, $this->charset);

} `

What browser(s) are you seeing the problem on?

No response

What version of PHP are you using?

8.5.9

What version of Roundcube are you using?

1.7.3

JavaScript errors

No response

PHP errors

No response