Colons within quoted parameter values are not handled correctly

Suppose an iCalendar file has the entry ORGANIZER;SENT-BY

Sun, 06 Jul 2008 19:19:53 +0000

Suppose an iCalendar file has the entry ORGANIZER;SENT-BY="mailto :a@b.c":mailto:a@b.c The ':' within the value of the parameter "SENT-BY" is taken as a separator between the parameters and the value of the ORGANIZER tag which is not correct. As per RFC 2445, we have in 4.1: param-value = paramtext / quoted-string quoted-string = DQUOTE *QSAFE-CHAR DQUOTE QSAFE-CHAR = WSP / %x21 / %x23-7E / NON-US-ASCII ; Any character except CTLs and DQUOTE so quoted parameter values can contain colons. A patch is attached. It changes the regular expression for breaking down the line into tag, parameters, and values from /([^;^:]*)((;[^:]*)?):([^\r\n]*)[\r\n]*/ to /([^;^:]*)((;[^;^:]*=(([^"^:^;][^:^;^"]*)|("[^"]*")))*):([^\r\n]*)[\r\n]*/

Changes have been made in CVS for this ticket: http://cvs.h

Sun, 06 Jul 2008 21:08:57 +0000

Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/framework/iCalendar/tests/read-escapes.phpt?r1=1.3&r2=1.4&ty=u

It's far more complicated than that unfortunately, because t

Sun, 06 Jul 2008 22:05:48 +0000

It's far more complicated than that unfortunately, because the same regex must also parse vCalendar 1.0 properties which are escaped differently. Those only require semicolons in parameter values to be escaped by a preceding backslash. I came up with the following so far: $name_re = '[-a-zA-Z0-9]+'; $param_text_re = '[^";:,]*'; $quoted_string_re = '"[^"]*"'; $param_value_re = $param_text_re . '|' . $quoted_string_re; $param_re = $name_re . '=' . $param_value_re; $old_param_re = '(?:' . $name_re . '=)?(?:[^;]|(?<=\\\\);)*'; And then run the preg_match like so: preg_match('/(' . $name_re . ')(;(?:' . $param_re . '|' . $old_param_re . '))*:([^\r\n]*)[\r\n]*/', $attribute, $parts); This doesn't work unfortunately either, because the regex for the old format is too greedy. If using an ungreedy modifier, it becomes too ungreedy.

This is the full (not working) patch.

Sun, 06 Jul 2008 22:07:01 +0000

This is the full (not working) patch.

Changes have been made in CVS for this ticket: http://cvs.h

Mon, 18 Aug 2008 22:25:49 +0000

Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/framework/iCalendar/tests/read-escapes.phpt?r1=1.4&r2=1.5&ty=u

Changes have been made in CVS for this ticket: http://cvs.h

Fri, 29 Aug 2008 13:34:42 +0000

Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/framework/iCalendar/iCalendar.php?r1=1.150&r2=1.151&ty=u

Fixed in CVS.

Fri, 29 Aug 2008 13:37:13 +0000

Fixed in CVS.