Bump MailKit to 4.15.1

Closes #11399

azure-pipelines.yml

@@ -1093,7 +1093,7 @@ stages:
         vmImage: ${{ variables.windowsImage }}
       steps:
       - checkout: self # Need history for Sonar analysis
-      - task: SonarCloudPrepare@4
+      - task: SonarCloudPrepare@3
         env:
           SONAR_SCANNER_OPTS: ''
         inputs:
@@ -1105,7 +1105,7 @@ stages:
           cliProjectName: 'RadarrUI'
           cliProjectVersion: '$(radarrVersion)'
           cliSources: './frontend'
-      - task: SonarCloudAnalyze@4
+      - task: SonarCloudAnalyze@3
 
     - job: Api_Docs
       displayName: API Docs
@@ -1182,7 +1182,7 @@ stages:
         submodules: true
       - powershell: Set-Service SCardSvr -StartupType Manual
         displayName: Enable Windows Test Service
-      - task: SonarCloudPrepare@4
+      - task: SonarCloudPrepare@3
         condition: eq(variables['System.PullRequest.IsFork'], 'False')
         inputs:
           SonarCloud: 'SonarCloud'
@@ -1200,7 +1200,7 @@ stages:
           ./build.sh --backend -f net8.0 -r win-x64
           TEST_DIR=_tests/net8.0/win-x64/publish/ ./test.sh Windows Unit Coverage
         displayName: Coverage Unit Tests
-      - task: SonarCloudAnalyze@4
+      - task: SonarCloudAnalyze@3
         condition: eq(variables['System.PullRequest.IsFork'], 'False')
         displayName: Publish SonarCloud Results
       - task: reportgenerator@5

src/NzbDrone.Common/Http/HttpUri.cs

@@ -6,13 +6,14 @@ using NzbDrone.Common.Extensions;
 
 namespace NzbDrone.Common.Http
 {
-    public class HttpUri : IEquatable<HttpUri>
+    public partial class HttpUri : IEquatable<HttpUri>
     {
-        private static readonly Regex RegexUri = new Regex(@"^(?:(?<scheme>[a-z]+):)?(?://(?<host>[-_A-Z0-9.]+|\[[[A-F0-9:]+\])(?::(?<port>[0-9]{1,5}))?)?(?<path>(?:(?:(?<=^)|/+)[^/?#\r\n]+)+/*|/+)?(?:\?(?<query>[^#\r\n]*))?(?:\#(?<fragment>.*))?$", RegexOptions.Compiled | RegexOptions.IgnoreCase);
-
         private readonly string _uri;
         public string FullUri => _uri;
 
+        [GeneratedRegex(@"^(?:(?<scheme>[a-z]+):)?(?://(?<host>[-_A-Z0-9.]+|\[[[A-F0-9:]+\])(?::(?<port>[0-9]{1,5}))?)?(?<path>(?:(?:(?<=^)|/+)[^/?#\r\n]+)+/*|/+)?(?:\?(?<query>[^#\r\n]*))?(?:\#(?<fragment>.*))?$", RegexOptions.IgnoreCase | RegexOptions.Compiled)]
+        private static partial Regex UriRegex();
+
         public HttpUri(string uri)
         {
             _uri = uri ?? string.Empty;
@@ -70,9 +71,9 @@ namespace NzbDrone.Common.Http
 
         private void Parse()
         {
-            var parseSuccess = Uri.TryCreate(_uri, UriKind.RelativeOrAbsolute, out var uri);
+            var parseSuccess = Uri.TryCreate(_uri, UriKind.RelativeOrAbsolute, out _);
 
-            var match = RegexUri.Match(_uri);
+            var match = UriRegex().Match(_uri);
 
             var scheme = match.Groups["scheme"];
             var host = match.Groups["host"];

src/NzbDrone.Core/Radarr.Core.csproj

@@ -6,7 +6,7 @@
     <PackageReference Include="Dapper" Version="2.1.66" />
     <PackageReference Include="Diacritical.Net" Version="1.0.4" />
     <PackageReference Include="Equ" Version="2.3.0" />
-    <PackageReference Include="MailKit" Version="4.13.0" />
+    <PackageReference Include="MailKit" Version="4.15.1" />
     <PackageReference Include="Microsoft.AspNetCore.Cryptography.KeyDerivation" Version="8.0.17" />
     <PackageReference Include="Microsoft.Data.SqlClient" Version="6.1.1" />
     <PackageReference Include="Npgsql" Version="9.0.3" />
@@ -22,7 +22,7 @@
     <PackageReference Include="FluentMigrator.Runner.SQLite" Version="6.2.0" />
     <PackageReference Include="FluentMigrator.Runner.Postgres" Version="6.2.0" />
     <PackageReference Include="FluentValidation" Version="9.5.4" />
-    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.11" />
+    <PackageReference Include="SixLabors.ImageSharp" Version="3.1.12" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="NLog" Version="5.4.0" />
     <PackageReference Include="MonoTorrent" Version="3.0.2" />

src/Radarr.Http/Frontend/Mappers/BackupFileMapper.cs

@@ -15,11 +15,13 @@ namespace Radarr.Http.Frontend.Mappers
             _backupService = backupService;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _backupService.GetBackupFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace("/backup/", "").Replace('/', Path.DirectorySeparatorChar);
 
-            return Path.Combine(_backupService.GetBackupFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/BrowserConfig.cs

@@ -8,13 +8,20 @@ namespace Radarr.Http.Frontend.Mappers
 {
     public class BrowserConfig : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
+        private readonly IConfigFileProvider _configFileProvider;
+
         public BrowserConfig(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "browserconfig.xml");
+            _appFolderInfo = appFolderInfo;
+            _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "browserconfig.xml");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Radarr.Http/Frontend/Mappers/CacheBreakerProvider.cs

@@ -37,6 +37,12 @@ namespace Radarr.Http.Frontend.Mappers
 
             var mapper = _diskMappers.Single(m => m.CanHandle(resourceUrl));
             var pathToFile = mapper.Map(resourceUrl);
+
+            if (pathToFile == null)
+            {
+                return resourceUrl;
+            }
+
             var hash = _hashProvider.ComputeMd5(pathToFile).ToBase64();
 
             return resourceUrl + "?h=" + hash.Trim('=');

src/Radarr.Http/Frontend/Mappers/FaviconMapper.cs

@@ -18,7 +18,9 @@ namespace Radarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var fileName = "favicon.ico";
 
@@ -29,7 +31,7 @@ namespace Radarr.Http.Frontend.Mappers
 
             var path = Path.Combine("Content", "Images", "Icons", fileName);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/HtmlMapperBase.cs

@@ -4,6 +4,7 @@ using System.Text.RegularExpressions;
 using NLog;
 using NzbDrone.Common.Disk;
 using NzbDrone.Common.EnvironmentInfo;
+using NzbDrone.Core.Configuration;
 
 namespace Radarr.Http.Frontend.Mappers
 {
@@ -13,19 +14,22 @@ namespace Radarr.Http.Frontend.Mappers
         private readonly Lazy<ICacheBreakerProvider> _cacheBreakProviderFactory;
         private static readonly Regex ReplaceRegex = new Regex(@"(?:(?<attribute>href|src)=\"")(?<path>.*?(?<extension>css|js|png|ico|ics|svg|json))(?:\"")(?:\s(?<nohash>data-no-hash))?", RegexOptions.Compiled | RegexOptions.IgnoreCase);
 
+        private string _urlBase;
         private string _generatedContent;
 
         protected HtmlMapperBase(IDiskProvider diskProvider,
+                                 IConfigFileProvider configFileProvider,
                                  Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                  Logger logger)
             : base(diskProvider, logger)
         {
             _diskProvider = diskProvider;
             _cacheBreakProviderFactory = cacheBreakProviderFactory;
+
+            _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string HtmlPath;
-        protected string UrlBase;
+        protected abstract string HtmlPath { get; }
 
         protected override Stream GetContentStream(string filePath)
         {
@@ -62,10 +66,10 @@ namespace Radarr.Http.Frontend.Mappers
                     url = cacheBreakProvider.AddCacheBreakerToPath(match.Groups["path"].Value);
                 }
 
-                return $"{match.Groups["attribute"].Value}=\"{UrlBase}{url}\"";
+                return $"{match.Groups["attribute"].Value}=\"{_urlBase}{url}\"";
             });
 
-            text = text.Replace("__URL_BASE__", UrlBase);
+            text = text.Replace("__URL_BASE__", _urlBase);
 
             _generatedContent = text;
 

src/Radarr.Http/Frontend/Mappers/IndexHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Radarr.Http.Frontend.Mappers
 {
     public class IndexHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public IndexHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,15 +17,16 @@ namespace Radarr.Http.Frontend.Mappers
                                IConfigFileProvider configFileProvider,
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, "index.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "index.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Radarr.Http/Frontend/Mappers/LogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Radarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/LoginHtmlMapper.cs

@@ -9,6 +9,7 @@ namespace Radarr.Http.Frontend.Mappers
 {
     public class LoginHtmlMapper : HtmlMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         public LoginHtmlMapper(IAppFolderInfo appFolderInfo,
@@ -16,14 +17,16 @@ namespace Radarr.Http.Frontend.Mappers
                                Lazy<ICacheBreakerProvider> cacheBreakProviderFactory,
                                IConfigFileProvider configFileProvider,
                                Logger logger)
-            : base(diskProvider, cacheBreakProviderFactory, logger)
+            : base(diskProvider, configFileProvider, cacheBreakProviderFactory, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            HtmlPath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "login.html");
-            UrlBase = configFileProvider.UrlBase;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string HtmlPath => Path.Combine(FolderPath, "login.html");
+
+        protected override string MapPath(string resourceUrl)
         {
             return HtmlPath;
         }

src/Radarr.Http/Frontend/Mappers/ManifestMapper.cs

@@ -8,6 +8,7 @@ namespace Radarr.Http.Frontend.Mappers
 {
     public class ManifestMapper : UrlBaseReplacementResourceMapperBase
     {
+        private readonly IAppFolderInfo _appFolderInfo;
         private readonly IConfigFileProvider _configFileProvider;
 
         private string _generatedContent;
@@ -15,11 +16,14 @@ namespace Radarr.Http.Frontend.Mappers
         public ManifestMapper(IAppFolderInfo appFolderInfo, IDiskProvider diskProvider, IConfigFileProvider configFileProvider, Logger logger)
             : base(diskProvider, configFileProvider, logger)
         {
+            _appFolderInfo = appFolderInfo;
             _configFileProvider = configFileProvider;
-            FilePath = Path.Combine(appFolderInfo.StartUpFolder, configFileProvider.UiFolder, "Content", "manifest.json");
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+        protected override string FilePath => Path.Combine(FolderPath, "Content", "manifest.json");
+
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Radarr.Http/Frontend/Mappers/MediaCoverMapper.cs

@@ -22,7 +22,9 @@ namespace Radarr.Http.Frontend.Mappers
             _diskProvider = diskProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.GetAppDataPath(), "MediaCover");
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);

src/Radarr.Http/Frontend/Mappers/RobotsTxtMapper.cs

@@ -18,11 +18,13 @@ namespace Radarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = Path.Combine("Content", "robots.txt");
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/StaticResourceMapper.cs

@@ -18,12 +18,14 @@ namespace Radarr.Http.Frontend.Mappers
             _configFileProvider = configFileProvider;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder);
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = path.Trim(Path.DirectorySeparatorChar);
 
-            return Path.Combine(_appFolderInfo.StartUpFolder, _configFileProvider.UiFolder, path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/StaticResourceMapperBase.cs

@@ -27,14 +27,28 @@ namespace Radarr.Http.Frontend.Mappers
             _caseSensitive = RuntimeInfo.IsProduction ? DiskProviderBase.PathStringComparison : StringComparison.OrdinalIgnoreCase;
         }
 
-        public abstract string Map(string resourceUrl);
+        protected abstract string FolderPath { get; }
+        protected abstract string MapPath(string resourceUrl);
 
         public abstract bool CanHandle(string resourceUrl);
 
+        public string Map(string resourceUrl)
+        {
+            var filePath = Path.GetFullPath(MapPath(resourceUrl));
+            var parentPath = Path.GetFullPath(FolderPath) + Path.DirectorySeparatorChar;
+
+            return filePath.StartsWith(parentPath) ? filePath : null;
+        }
+
         public Task<IActionResult> GetResponse(string resourceUrl)
         {
             var filePath = Map(resourceUrl);
 
+            if (filePath == null)
+            {
+                return Task.FromResult<IActionResult>(null);
+            }
+
             if (_diskProvider.FileExists(filePath, _caseSensitive))
             {
                 if (!_mimeTypeProvider.TryGetContentType(filePath, out var contentType))

src/Radarr.Http/Frontend/Mappers/UpdateLogFileMapper.cs

@@ -16,12 +16,14 @@ namespace Radarr.Http.Frontend.Mappers
             _appFolderInfo = appFolderInfo;
         }
 
-        public override string Map(string resourceUrl)
+        protected override string FolderPath => _appFolderInfo.GetUpdateLogFolder();
+
+        protected override string MapPath(string resourceUrl)
         {
             var path = resourceUrl.Replace('/', Path.DirectorySeparatorChar);
             path = Path.GetFileName(path);
 
-            return Path.Combine(_appFolderInfo.GetUpdateLogFolder(), path);
+            return Path.Combine(FolderPath, path);
         }
 
         public override bool CanHandle(string resourceUrl)

src/Radarr.Http/Frontend/Mappers/UrlBaseReplacementResourceMapperBase.cs

@@ -20,9 +20,9 @@ namespace Radarr.Http.Frontend.Mappers
             _urlBase = configFileProvider.UrlBase;
         }
 
-        protected string FilePath;
+        protected abstract string FilePath { get; }
 
-        public override string Map(string resourceUrl)
+        protected override string MapPath(string resourceUrl)
         {
             return FilePath;
         }

src/Radarr.Http/Frontend/StaticResourceController.cs

@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Linq;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Cors;
@@ -16,6 +17,7 @@ namespace Radarr.Http.Frontend
     {
         private readonly IEnumerable<IMapHttpRequestsToDisk> _requestMappers;
         private readonly Logger _logger;
+        private static readonly Regex InvalidPathRegex = new (@"([\/\\]|%2f|%5c)\.\.|\.\.([\/\\]|%2f|%5c)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
 
         public StaticResourceController(IEnumerable<IMapHttpRequestsToDisk> requestMappers,
             Logger logger)
@@ -50,6 +52,11 @@ namespace Radarr.Http.Frontend
         {
             path = "/" + (path ?? "");
 
+            if (InvalidPathRegex.IsMatch(path))
+            {
+                return NotFound();
+            }
+
             var mapper = _requestMappers.SingleOrDefault(m => m.CanHandle(path));
 
             if (mapper != null)