sanitizing

lib/Service/MailService.php

@@ -170,8 +170,10 @@ private function verifyInfoAndPassword($content, $toInfo) {
 	 * @throws NotPermittedException
 	 */
 	private function getMailFolder($userId, $to, $from) {
-
 		$node = \OC::$server->getUserFolder($userId);
+		$to = $this->parseMailAddress($to);
+		$from = $this->parseMailAddress($from);
+
 		$folderPath = 'Mails sent to ' . $to . '/From ' . $from . '/';
 
 		if (!$node->nodeExists($folderPath)) {
@@ -371,4 +373,25 @@ private function saveMailAddresses($addresses) {
 	}
 
 
+	/**
+	 * @param string $address
+	 *
+	 * @return string
+	 */
+	private function parseMailAddress($address) {
+		$acceptedChars = 'qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM0123456789@.-_+';
+
+		$fixed = '';
+		for ($i = 0; $i < strlen($address); $i++) {
+			$c = $address[$i];
+			if (strpos($acceptedChars, $c) !== false) {
+				$fixed .= $c;
+			}
+		}
+
+		$fixed = str_replace('..', '.', $fixed);
+
+		return $fixed;
+	}
+
 }