[SECURITY] Harden message deserialization in QueueableFileTransport

Classes/Exception/SerializedMessageIsInvalid.php

@@ -31,11 +31,12 @@
  */
 final class SerializedMessageIsInvalid extends Exception
 {
-    public function __construct(string $file)
+    public function __construct(string $file, ?\Throwable $previous = null)
     {
         parent::__construct(
             sprintf('The file "%s" does not contain a valid serialized message.', $file),
             1709133596,
+            $previous,
         );
     }
 }

Classes/Mail/Transport/QueueableFileTransport.php

@@ -51,8 +51,9 @@ public function __construct(
         string $path,
         ?EventDispatcher\EventDispatcherInterface $dispatcher = null,
         ?Log\LoggerInterface $logger = null,
+        Core\Serializer\PolymorphicDeserializer $deserializer = new Core\Serializer\PolymorphicDeserializer(),
     ) {
-        parent::__construct($path, $dispatcher, $logger);
+        parent::__construct($path, $dispatcher, $logger, $deserializer);
         $this->context = Core\Utility\GeneralUtility::makeInstance(Core\Context\Context::class);
     }
 
@@ -221,20 +222,29 @@ private function restoreItem(\SplFileInfo $file): Mail\Queue\MailQueueItem
     {
         $path = (string)$file->getRealPath();
         $lastChanged = $file->getMTime();
+        $exception = null;
 
         // Unserialize message
-        $message = unserialize((string)file_get_contents($path), [
-            'allowedClasses' => [
-                Mime\RawMessage::class,
-                Mime\Message::class,
-                Mime\Email::class,
-                Mailer\DelayedEnvelope::class,
-                Mailer\Envelope::class,
-            ],
-        ]);
+        try {
+            $message = $this->deserializer->deserialize(
+                (string)file_get_contents($path),
+                [
+                    Mailer\SentMessage::class,
+                    Mime\RawMessage::class,
+                    Mailer\Envelope::class,
+                    Mime\Address::class,
+                    Mime\Part\AbstractPart::class,
+                    Mime\Part\File::class, // This one does not extend AbstractPart
+                    Mime\Header\Headers::class,
+                    Mime\Header\HeaderInterface::class,
+                ],
+            );
+        } catch (\Throwable $exception) {
+            $message = null;
+        }
 
         if (!($message instanceof Mailer\SentMessage)) {
-            throw new Exception\SerializedMessageIsInvalid($path);
+            throw new Exception\SerializedMessageIsInvalid($path, $exception);
         }
 
         // Define mail state

composer.json

@@ -18,9 +18,9 @@
 		"symfony/console": "^5.4 || ^6.4 || ^7.0",
 		"symfony/mailer": "^5.4 || ^6.4 || ^7.0",
 		"symfony/mime": "^5.4 || ^6.4 || ^7.0",
-		"typo3/cms-backend": "~11.5.42 || ~12.4.25 || ~13.4.3",
-		"typo3/cms-core": "~11.5.42 || ~12.4.25 || ~13.4.3",
-		"typo3/cms-fluid": "~11.5.42 || ~12.4.25 || ~13.4.3",
+		"typo3/cms-backend": "~11.5.49 || ~12.4.41 || ~13.4.23",
+		"typo3/cms-core": "~11.5.49 || ~12.4.41 || ~13.4.23",
+		"typo3/cms-fluid": "~11.5.49 || ~12.4.41 || ~13.4.23",
 		"typo3fluid/fluid": "^2.15 || ^4.0"
 	},
 	"require-dev": {
@@ -35,7 +35,7 @@
 		"phpunit/phpcov": "^9.0 || ^10.0",
 		"saschaegerer/phpstan-typo3": "^1.10",
 		"ssch/typo3-rector": "^2.0",
-		"typo3/cms-lowlevel": "~11.5.42 || ~12.4.25 || ~13.4.3",
+		"typo3/cms-lowlevel": "~11.5.49 || ~12.4.41 || ~13.4.23",
 		"typo3/coding-standards": "^0.7.0 || ^0.8.0",
 		"typo3/testing-framework": "^7.0.2 || ^8.0.9 || ^9.0.1"
 	},

ext_emconf.php

@@ -32,7 +32,7 @@
     'author_company' => 'coding. powerful. systems. CPS GmbH',
     'constraints' => [
         'depends' => [
-            'typo3' => '11.5.42-13.4.99',
+            'typo3' => '11.5.49-13.4.99',
             'php' => '8.1.0-8.4.99',
         ],
     ],