Subject: bug#51733: 27.1; Detect impossible email addresses better

From: Lars Ingebrigtsen <[email-masked]>
Date: Wed, 19 Jan 2022 15:09:54 +0100

Andreas Schwab <[email-masked]> writes:

> The why not allow to run the textsec on the decoded header directly?

Consider somebody sending you an email containing @", characters in the
name part, and then you decode the address, and then run the parsing
function.  The attacker would then have a wide attack surface to trick
the checker into checking the wrong parts of the address.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no