Replacement character (�) in IMAP folder name prevents Roundcube from listing any mail

[ptr999]

We've noticed some odd mail client when creating folder names that contain the Swedish characters 'å' this is saved
in courierimapsubscribed in hex <8c> (�).

(Edit: Note, normally åäö characters (and umlauts) are correctly encoded per “modified-UTF7” as
we haven't upgraded to courier 5.x that uses UTF8.
So this problem is caused by some very uncommon client).

Example, folder named "brevlådor" is saved as INBOX.brevl<8C>dor in courierimapsubscribed, directory is then created as
".brevl?dor" or ".brevl\214dor" escaped for non graphic chars.

When courier-imapd sends folder listing it looks like this:

[17-Mar-2021 13:06:47 +0000]: <3rkd3v67> [1572] S: * LIST (\HasNoChildren) "." "INBOX.brevl<8C>dor"

This seems to make Roundcube unable to list any e-mails and being able to change to any other
folder and also reporting that mailbox is empty.

Under Settings and Folders you're unable to create or delete any of the folders, unsubscribe also
doesn't work.
Also when trying to log out the CSRF check is triggered

Only way to fix this is to delete the directory ".brevl?dor" manually on the mail filesystem.

Thunderbird seems to handle this except the folder ".brevl?dor".

This may partly be an issue with courier-imapd but at the same time maybe Roundcube shouldn't
break in this way when one folder has an invalid character?

Above all tested with RC version 1.4.11.

[alecpl]

Confirmed. Obviously a Courier bug, but I guess we should remove non-utf-8 characters. Having this one folder non-working would be acceptable, but this breaks the whole UI.

[alecpl]

The simplest and most generic fix would be to use JSON_INVALID_UTF8_SUBSTITUTE flag in json_encode(). Requires PHP 7.2.

Anything more, e.g. making the broken folder working would be much more work.

[alecpl]

I fixed the general issue with invalid characters in JSON output. I don't plan to backport this to 1.4.

Any other fixes for this specific issue would be much more work, but I think this case is not worth the effort.