GNU bug report logs - #51733
27.1; Detect impossible email addresses better

Previous Next

Full log

View this message in rfc822 format

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Andreas Schwab <schwab <at> linux-m68k.org>
Cc: 51733 <at> debbugs.gnu.org, Eli Zaretskii <eliz <at> gnu.org>
Subject: bug#51733: 27.1; Detect impossible email addresses better
Date: Wed, 19 Jan 2022 15:33:54 +0100

Andreas Schwab <schwab <at> linux-m68k.org> writes:

> On Jan 19 2022, Lars Ingebrigtsen wrote:
>
>> Consider somebody sending you an email containing @", characters in the
>> name part, and then you decode the address, and then run the parsing
>> function.  The attacker would then have a wide attack surface to trick
>> the checker into checking the wrong parts of the address.
>
> Isn't that the whole point of textsec?

It's perfectly valid to have a

From: "larsi <at> example.com" <larsi <at> other.com>

address.  It's unambigious, and the responses will go to
larsi <at> other.com.

Of course, it's...  suspicious...  but not on the Unicode level.  (I'll
also be adding some non-Unicode bits to textsec, like

<a href="http://foo.bar">http://other.bar</a>

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.