Subject: bug#47616: 27.1; hardening mail-envelope-from

From: Francesco Potortì <[email-masked]>
Date: Thu, 06 May 2021 14:16:29 +0200

>Francesco Potortì <[email-masked]> writes:
>> Hardening mail-envelope-from from sendmail.el by narrowing to the
>> headers, as the doc says, corrects the problem that I observed.
>
>Thanks -- I don't think we should change mail-envelope-from itself here,
>because it may conceivably be called from other contexts.  Instead the
>callers in sendmail/smtpmail should be altered to narrow to the headers
>before calling it, and I've now done this in Emacs 28.  (This uncovered
>a similar bug in smtpmail.el, too.)

That makes sense, in principle.  I would argue for adding a comment to
mail-envelope-from stating that since it calls mail-fetch-field it
should be called only after narrowing to the headers.  Or maybe even
adding a note in the doc string, as done in mail-fetch-field.