security: harden filename and socket payload handling

- sanitize SUBJECT-derived filenames in output_all_mail_as_file and
  reject path traversal via basename, separator stripping, and a
  commonpath check so writes cannot escape cwd
- validate socket server JSON payloads (shape, size, command-name
  types) before dispatching to the executor, and guard recv against
  buffer overflow and undecodable bytes
- route library-code diagnostics through mail_thunder_logger instead
  of print(), and correct docstring placement in the IMAP wrapper

Author: JE-Chen

je_mail_thunder/imap/imap_wrapper.py

@@ -1,3 +1,5 @@
+import os
+import re
 from email import message_from_bytes
 from email import policy
 from email.header import decode_header
@@ -93,13 +95,13 @@ def search_mailbox(self, search_str: [str, list] = "ALL", charset: str = None) -
 
     def mail_content_list(
             self, search_str: [str, list] = "ALL", charset: str = None) -> List[Dict[str, Union[str, bytes]]]:
-        mail_thunder_logger.info(f"imap_mail_content_list, search_str: {search_str}, charset: {charset}")
         """
         Get all mail content as list
         :param search_str: Search pattern
-        :param charset: Charset pattern 
+        :param charset: Charset pattern
         :return: All mail content as list [{"SUBJECT": "mail_subject", "FROM": "mail_from", "TO": "mail_to"}]
         """
+        mail_thunder_logger.info(f"imap_mail_content_list, search_str: {search_str}, charset: {charset}")
         try:
             mail_list = self.search_mailbox(search_str, charset)
             mail_content_dict = dict()
@@ -124,32 +126,54 @@ def mail_content_list(
             mail_thunder_logger.error(
                 f"imap_mail_content_list, search_str: {search_str}, charset: {charset}, failed: {repr(error)}")
 
+    @staticmethod
+    def _sanitize_subject_as_filename(subject) -> str:
+        """
+        Derive a safe filename from a mail SUBJECT header.
+        Strips directory components and any separator / traversal token.
+        Falls back to "mail" when the sanitized result is empty.
+        """
+        if subject is None:
+            return "mail"
+        name = os.path.basename(str(subject))
+        name = name.replace("\x00", "")
+        name = re.sub(r"[\\/\r\n\t]", "_", name)
+        while ".." in name:
+            name = name.replace("..", "_")
+        name = name.strip(" .")
+        return name if name else "mail"
+
     def output_all_mail_as_file(
             self, search_str: [str, list] = "ALL", charset: str = None) -> List[Dict[str, Union[str, bytes]]]:
-        mail_thunder_logger.info(f"imap_mail_content_list, search_str: {search_str}, charset: {charset}")
         """
         Get all mail content data and output as file
         :param search_str: Search pattern
-        :param charset: Charset pattern 
+        :param charset: Charset pattern
         :return: All mail content as list [{"SUBJECT": "mail_subject", "FROM": "mail_from", "TO": "mail_to"}]
         """
+        mail_thunder_logger.info(f"imap_output_all_mail_as_file, search_str: {search_str}, charset: {charset}")
         try:
             all_mail = self.mail_content_list(search_str=search_str, charset=charset)
             same_name_dict: Dict[str, int] = dict()
+            cwd = os.path.abspath(os.getcwd())
             for mail in all_mail:
-                if same_name_dict.get((mail.get("SUBJECT"))) is None:
-                    same_name_dict.update({mail.get("SUBJECT"): 0})
-                else:
-                    same_name_dict.update({mail.get("SUBJECT"): same_name_dict.get(mail.get("SUBJECT")) + 1})
-                with open(mail.get("SUBJECT") + str(same_name_dict.get(mail.get("SUBJECT"))), "w+") as file:
+                safe_name = self._sanitize_subject_as_filename(mail.get("SUBJECT"))
+                count = same_name_dict.get(safe_name, -1) + 1
+                same_name_dict[safe_name] = count
+                target_path = os.path.abspath(os.path.join(cwd, safe_name + str(count)))
+                if os.path.commonpath([cwd, target_path]) != cwd:
+                    mail_thunder_logger.error(
+                        f"imap_output_all_mail_as_file, rejected path traversal: {target_path}")
+                    continue
+                with open(target_path, "w+") as file:
                     if isinstance(mail.get("BODY"), bytes):
                         file.write(mail.get("BODY").decode("utf-8"))
                     else:
                         file.write(mail.get("BODY"))
             return all_mail
         except Exception as error:
             mail_thunder_logger.error(
-                f"imap_mail_content_list, search_str: {search_str}, charset: {charset}, failed: {repr(error)}")
+                f"imap_output_all_mail_as_file, search_str: {search_str}, charset: {charset}, failed: {repr(error)}")
 
     def quit(self):
         """

je_mail_thunder/utils/executor/action_executor.py

@@ -85,8 +85,7 @@ def execute_action(self, action_list: [list, dict]) -> dict:
                 execute_record = "execute: " + str(action)
                 execute_record_dict.update({execute_record: repr(error)})
         for key, value in execute_record_dict.items():
-            print(key, flush=True)
-            print(value, flush=True)
+            mail_thunder_logger.info(f"{key} -> {value}")
         return execute_record_dict
 
     def execute_files(self, execute_files_list: list) -> list:

je_mail_thunder/utils/package_manager/package_manager_class.py

@@ -1,7 +1,6 @@
 from importlib import import_module
 from importlib.util import find_spec
 from inspect import getmembers, isfunction, isbuiltin, isclass
-from sys import stderr
 
 from je_mail_thunder.utils.logging.loggin_instance import mail_thunder_logger
 
@@ -27,7 +26,7 @@ def check_package(self, package: str):
                     self.installed_package_dict.update(
                         {found_spec.name: installed_package})
                 except ModuleNotFoundError as error:
-                    print(repr(error), file=stderr)
+                    mail_thunder_logger.error(repr(error))
         return self.installed_package_dict.get(package, None)
 
     def add_package_to_executor(self, package):
@@ -62,10 +61,10 @@ def get_member(self, package, predicate, target):
                 target.event_dict.update(
                     {str(package) + "_" + str(member[0]): member[1]})
         elif installed_package is None:
-            print(repr(ModuleNotFoundError(f"Can't find package {package}")),
-                  file=stderr)
+            mail_thunder_logger.error(
+                repr(ModuleNotFoundError(f"Can't find package {package}")))
         else:
-            print(f"Executor error {self.executor}", file=stderr)
+            mail_thunder_logger.error(f"Executor error {self.executor}")
 
     def add_package_to_target(self, package, target):
         """
@@ -89,7 +88,7 @@ def add_package_to_target(self, package, target):
                 target=target
             )
         except Exception as error:
-            print(repr(error), file=stderr)
+            mail_thunder_logger.error(repr(error))
 
 
 package_manager = PackageManager()

je_mail_thunder/utils/socket_server/mail_thunder_socket_server.py

@@ -5,11 +5,48 @@
 
 from je_mail_thunder.utils.executor.action_executor import execute_action
 
+MAX_PAYLOAD_BYTES = 8192
+MAX_ACTIONS = 256
+
+
+def _validate_payload(payload):
+    """
+    Validate the decoded JSON payload structure before execution.
+    Accepts either a list of action entries or a dict with an
+    "auto_control" key mapping to such a list. Each action entry must
+    be a non-empty list whose first element is a string command name.
+    """
+    if isinstance(payload, dict):
+        actions = payload.get("auto_control")
+        if not isinstance(actions, list):
+            raise ValueError("payload dict must contain 'auto_control' list")
+    elif isinstance(payload, list):
+        actions = payload
+    else:
+        raise ValueError("payload must be a dict or list")
+    if len(actions) == 0:
+        raise ValueError("action list is empty")
+    if len(actions) > MAX_ACTIONS:
+        raise ValueError(f"action list exceeds max length {MAX_ACTIONS}")
+    for entry in actions:
+        if not isinstance(entry, list) or len(entry) == 0 or len(entry) > 2:
+            raise ValueError(f"invalid action entry: {entry!r}")
+        if not isinstance(entry[0], str):
+            raise ValueError(f"action command name must be str: {entry!r}")
+
 
 class TCPServerHandler(socketserver.BaseRequestHandler):
 
     def handle(self):
-        command_string = str(self.request.recv(8192).strip(), encoding="utf-8")
+        raw = self.request.recv(MAX_PAYLOAD_BYTES).strip()
+        if len(raw) >= MAX_PAYLOAD_BYTES:
+            print("payload exceeds max buffer size; rejected", file=sys.stderr, flush=True)
+            return
+        try:
+            command_string = str(raw, encoding="utf-8")
+        except UnicodeDecodeError as error:
+            print(repr(error), file=sys.stderr, flush=True)
+            return
         socket = self.request
         print("command is: " + command_string, flush=True)
         if command_string == "quit_server":
@@ -19,6 +56,7 @@ def handle(self):
         else:
             try:
                 execute_str = json.loads(command_string)
+                _validate_payload(execute_str)
                 for execute_function, execute_return in execute_action(execute_str).items():
                     socket.sendto(str(execute_return).encode("utf-8"), self.client_address)
                     socket.sendto("\n".encode("utf-8"), self.client_address)