From fc3dc50c1c6fef5ef017c50af87304804bfa8947 Mon Sep 17 00:00:00 2001
From: Sergey Semenov <ssemenov@magento.com>
Date: Tue, 17 Jan 2017 15:09:21 +0200
Subject: [PATCH] MAGETWO-63137: Fix Zend Mail vulnerability

---
 library/Zend/Mail/Transport/Sendmail.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/library/Zend/Mail/Transport/Sendmail.php b/library/Zend/Mail/Transport/Sendmail.php
index b24026b315..3487cd5fda 100644
--- a/library/Zend/Mail/Transport/Sendmail.php
+++ b/library/Zend/Mail/Transport/Sendmail.php
@@ -194,6 +194,18 @@ protected function _prepareHeaders($headers)
             unset($headers['Subject']);
         }
 
+        // Sanitize the From header
+        if (isset($headers['From'])) {
+            $addressList = array_filter($headers['From'], function($key) {
+                return $key !== 'append';
+            }, ARRAY_FILTER_USE_KEY);
+            foreach ($addressList as $address) {
+                if (preg_match('/\\\"/', $address)) {
+                    throw new Zend_Mail_Transport_Exception('Potential code injection in From header');
+                }
+            }
+        }
+
         // Prepare headers
         parent::_prepareHeaders($headers);