mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-28 15:02:28 +00:00
Alberto Bertogli
9de93edf77
Today we rely on net/mail.ParseAddress to do most of the validation of the addresses, and it is quite effective at it. But it does not reject addresses with control characters, which could end up verbatim in problematic places (e.g. logs). Specifically the C1 characters, like U+009B (Control Sequence Introducer) will pass through and could be problematic, since it is interpreted by some terminals. It also allows (quoted) parenthesis, which could confuse Received header parsers. This is mainly harmless, but it can be confusing when troubleshooting. Today, we also reject addresses with more than one @, but as a side-effect of domain validation. To reduce the chances of problems later, this patch rejects addresses if they contain control characters (which is a behaviour change), or more than one @ (which is pre-existing, but now we fail in a more explicit way). It also escapes the addresses containing parenthesis in the Received header, to make debugging info clearer, and keep the header structure compliant.