Subject: Re: bug#51733: 27.1; Detect impossible email addresses better

From: Lars Ingebrigtsen <[email-masked]>
Date: Wed, 19 Jan 2022 15:33:54 +0100

Andreas Schwab <[email-masked]> writes:

> On Jan 19 2022, Lars Ingebrigtsen wrote:
>
>> Consider somebody sending you an email containing @", characters in the
>> name part, and then you decode the address, and then run the parsing
>> function.  The attacker would then have a wide attack surface to trick
>> the checker into checking the wrong parts of the address.
>
> Isn't that the whole point of textsec?

It's perfectly valid to have a

From: "[email-masked]" <[email-masked]>

address.  It's unambigious, and the responses will go to
[email-masked].

Of course, it's...  suspicious...  but not on the Unicode level.  (I'll
also be adding some non-Unicode bits to textsec, like

<a href="http://foo.bar">http://other.bar</a>

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no