Skip to content

Conversation

@bengotow
Copy link
Collaborator

@bengotow bengotow commented Jan 6, 2026

We need to parse these on the C++ side to populate the EventSearch table properly.

claude added 4 commits January 6, 2026 03:45
- Add UnescapeICSText helper to properly decode RFC 5545 escaped text
  (handles \n, \\, \,, \; escape sequences)
- Add Location field to ICalendarEvent struct
- Add Attendees list to ICalendarEvent struct
- Parse LOCATION property with proper text unescaping
- Parse ATTENDEE properties, extracting CN parameter and mailto: address,
  formatting as "Name <email>" or just email
- Expose location and participants fields in Event model JSON
Extract the ATTENDEE line parsing logic into a separate inline function
for improved readability. Also revert Event.cpp changes - the location
and participants fields will be attached to the event system separately.
Security fixes for untrusted ICS data from external CalDAV servers:

- Prevent CN parameter injection by only searching for CN= in the
  parameter section (before the colon), not in the email address portion
- Use case-insensitive matching for CN= per RFC 5545 Section 3.1
- Use case-insensitive matching for mailto: per RFC 3986
- Handle malformed lines (missing colon) gracefully
- Add security documentation comments
@bengotow bengotow merged commit a6592d2 into master Jan 6, 2026
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants