File paths of archived messages may be exposed in the result of arcsearch

[ikedas]

Version

All.

Installation method

Any.

Expected behavior

Absolute file paths of archived messages should not be exposed through the operation with web interface.

Actual behavior

If the list name contains the metacharacter, e.g. +, the absolute file paths of the messages may be exposed in the result of arcsearch action of web interface.

Steps to reproduce

1. Create a list with the name list+test.
2. Post any messages to the list and fill its archive.
3. Visit archive page of the list and then perform archive search.

The links to the messages in the search result are incorrect: They contain absolute file paths to the archived messages instead of their proper URLs.

Additional information

This flaw is found in the all releases of Sympa, since arcsearch feature has been introduced.