Subject: feat: add MimeParser with GMime and safe attachment naming

From: "Danilo M." <[email-masked]>
Date: Sun, 2 Aug 2026 17:27:07 +0200

---
 tests/fixtures/hostile_filename.eml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 tests/fixtures/hostile_filename.eml

(limited to 'tests/fixtures/hostile_filename.eml')

diff --git a/tests/fixtures/hostile_filename.eml b/tests/fixtures/hostile_filename.eml
new file mode 100644
index 0000000..4dc79b6
--- /dev/null
+++ b/tests/fixtures/hostile_filename.eml
@@ -0,0 +1,17 @@
+From: Attacker <[email-masked]>
+Subject: Hostile attachment name
+Date: Sat, 01 Aug 2026 10:00:00 +0000
+Message-ID: <[email-masked]>
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="EVIL"
+
+--EVIL
+Content-Type: text/plain; charset=utf-8
+
+body
+--EVIL
+Content-Type: text/plain; name="../../../../tmp/pwned.txt"
+Content-Disposition: attachment; filename="../../../../tmp/pwned.txt"
+
+owned
+--EVIL--
-- 
cgit v1.2.3