[Debian GNUstep maintainers] Bug#1150228: sogo: Also affects trixie; breaks sogo 5.12.1-3+deb13u3 UI

[Ingo Juergensmann]

Package: sogo
Followup-For: Bug #1150228

Dear Maintainer,


This also affects stable. trixie still ships libgnustep-base1.31 1.31.1-3,
which lacks the NSRegularExpression fix (1.31.1-5 in unstable/testing).

sogo 5.12.1-3+deb13u3 (DSA-6561-1, trixie-security) adds XSS patches
("escape angularJS directive for description", "add stripAngular to
stringWithoutHTMLInjection calls", "use legitimate sorting value"). With
them on trixie I see two UI regressions:

- Webmail cannot return to the Inbox when the message list is sorted by
  "Order Received" (sort=arrival, the default). No request is sent and
  nothing is logged. With sort=date it works.
- The invitation card shows "{\{$chip.name}/}" instead of the attendee
  name, although the ATTENDEE line has a valid CN.

I suspect nil results from NSRegularExpression replacements that yield an
empty string, but I have not verified it. Could the fix be made available
in trixie / trixie-security?

Regards, 
Ingo 

-- System Information:
Debian Release: 13.7
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.111+deb13-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_DE:en_US:en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages sogo depends on:
ii  adduser                                       3.152
ii  gnustep-base-runtime                          1.31.1-3
ii  gnustep-multiarch [gnustep-layout-multiarch]  2.9.3-6
ii  init-system-helpers                           1.69~deb13u1
ii  libc6                                         2.41-12+deb13u4
ii  libcrypt1                                     1:4.4.38-1
ii  libcurl4t64                                   8.14.1-2+deb13u7
ii  libgcc-s1                                     14.2.0-19
ii  libglib2.0-0t64                               2.84.4-3~deb13u5
ii  libgnustep-base1.31                           1.31.1-3
ii  liblasso3t64                                  2.8.2-9+deb13u1
ii  libmemcached11t64                             1.1.4-1.1+b2
ii  liboath0t64                                   2.6.12-1
ii  libobjc4                                      14.2.0-19
ii  libsbjson2.3t64                               2.3.2-5+b1
ii  libsodium23                                   1.0.18-1+deb13u1
ii  libsope1                                      5.12.1-2
ii  libssl3t64                                    3.5.7-1~deb13u3
ii  libytnef0                                     2.1.2-1+b2
ii  libzip5                                       1.11.3-2
ii  lsb-base                                      11.6
ii  memcached                                     1.6.38-1
ii  sogo-common                                   5.12.1-3+deb13u3
ii  systemd                                       257.13-1~deb13u1
ii  sysvinit-utils [lsb-base]                     3.14-4
ii  zip                                           3.0-15+deb13u1

sogo recommends no packages.

Versions of packages sogo suggests:
ii  postgresql  17+278

-- Configuration Files:
/etc/sogo/sogo.conf [Errno 13] Permission denied: '/etc/sogo/sogo.conf'

-- no debconf information