Harden email-address class against multiple mailto-uri's (seen in the…

… wild in eduGAIN)

src/SAML2/XML/md/EmailAddress.php

@@ -56,7 +56,7 @@ protected function validateContent(string $content): void
      */
     protected function sanitizeContent(string $content): string
     {
-        return trim(preg_replace('/^mailto:/i', '', $content));
+        return trim(preg_replace('/^(mailto:)+/i', '', $content));
     }
 
 

tests/SAML2/XML/md/EmailAddressTest.php

@@ -54,11 +54,11 @@ public static function setUpBeforeClass(): void
      */
     public function testMarshalling(): void
     {
-        $name = new EmailAddress('[email protected]');
+        $email = new EmailAddress('[email protected]');
 
         $this->assertEquals(
             self::$xmlRepresentation->saveXML(self::$xmlRepresentation->documentElement),
-            strval($name),
+            strval($email),
         );
     }
 
@@ -89,4 +89,17 @@ public function testUnmarshallingWithInvalidEmail(): void
 
         EmailAddress::fromXML($document->documentElement);
     }
+
+
+    /**
+     * Test that creating an EmailAddress from XML succeeds when multiple mailto: prefixes are in place.
+     */
+    public function testUnmarshallingWithMultipleMailtoUri(): void
+    {
+        $document = clone self::$xmlRepresentation;
+        $document->documentElement->textContent = 'mailto:mailto:mailto:[email protected]';
+
+        $email = EmailAddress::fromXML($document->documentElement);
+        $this->assertEquals('mailto:[email protected]', $email->getContent());
+    }
 }