{"thread":{"id":"21301","subject":"git-send-email.perl defect: address missing trailing > accepted","startedAt":"2009-10-20T22:12:47Z","lastAt":"2009-10-20T23:28:59Z","messageCount":6,"participants":["Joe Perches","Erik Faye-Lund","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"125538","messageId":"1256076767.2029.59.camel@Joe-Laptop.home","threadId":"21301","inReplyTo":null,"subject":"git-send-email.perl defect: address missing trailing > accepted","fromName":"Joe Perches","fromEmail":"joe@perches.com","sentAt":"2009-10-20T22:12:47Z","receivedAt":"2009-10-20T22:12:47Z","isPatch":false,"sender":{"key":"joe@perches.com","avatar":"https://avatars.githubusercontent.com/u/13122723?v=4"},"body":"I typo cut/pasted an invalid email address,\nneglecting to copy the trailing \">\".\n\nwas:\t\"Name \"\n\nAnyone have suggestions on how to get\ngit-send-email.perl to notify and abort\nsending on more invalid address styles?\n"},{"id":"125541","messageId":"40aa078e0910201529m338ef3d1o4fa1a31c3dcc2a20@mail.gmail.com","threadId":"21301","inReplyTo":"1256076767.2029.59.camel@Joe-Laptop.home","subject":"Re: git-send-email.perl defect: address missing trailing > accepted","fromName":"Erik Faye-Lund","fromEmail":"kusmabite@googlemail.com","sentAt":"2009-10-20T22:29:55Z","receivedAt":"2009-10-20T22:29:55Z","isPatch":false,"sender":{"key":"kusmabite@gmail.com","avatar":"https://avatars.githubusercontent.com/u/47073?v=4"},"body":"On Wed, Oct 21, 2009 at 12:12 AM, Joe Perches wrote:\n> I typo cut/pasted an invalid email address,\n> neglecting to copy the trailing \">\".\n>\n> was:    \"Name needed: \"Name \"\n>\n> Anyone have suggestions on how to get\n> git-send-email.perl to notify and abort\n> sending on more invalid address styles?\n\nSomething along these lines? Of course, the error message is, uhm,\nless than helpful :)\n\n--->8---\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex f5ba4e7..83f5e80 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -787,6 +787,10 @@ sub is_rfc2047_quoted {\n sub sanitize_address\n {\n \tmy ($recipient) = @_;\n+\tif ($recipient =~ m/.*<[^>]*$/) {\n+\t\tdie \"EEK!\"\n+\t}\n+\n \tmy ($recipient_name, $recipient_addr) = ($recipient =~ /^(.*?)\\s*(<.*)/);\n\n \tif (not $recipient_name) {\n\n\n-- \nErik \"kusma\" Faye-Lund\n"},{"id":"125544","messageId":"1256078917.2029.77.camel@Joe-Laptop.home","threadId":"21301","inReplyTo":"40aa078e0910201529m338ef3d1o4fa1a31c3dcc2a20@mail.gmail.com","subject":"Re: git-send-email.perl defect: address missing trailing > accepted","fromName":"Joe Perches","fromEmail":"joe@perches.com","sentAt":"2009-10-20T22:48:37Z","receivedAt":"2009-10-20T22:48:37Z","isPatch":false,"sender":{"key":"joe@perches.com","avatar":"https://avatars.githubusercontent.com/u/13122723?v=4"},"body":"On Wed, 2009-10-21 at 00:29 +0200, Erik Faye-Lund wrote:\n> On Wed, Oct 21, 2009 at 12:12 AM, Joe Perches wrote:\n> > I typo cut/pasted an invalid email address,\n> > neglecting to copy the trailing \">\".\n> > was: \"Name > needed: \"Name \"\n> > Anyone have suggestions on how to get\n> > git-send-email.perl to notify and abort\n> > sending on more invalid address styles?\n> \n> Something along these lines? Of course, the error message is, uhm,\n> less than helpful :)\n> \n> --- a/git-send-email.perl\n> +++ b/git-send-email.perl\n> @@ -787,6 +787,10 @@ sub is_rfc2047_quoted {\n> sub sanitize_address\n> {\n> \tmy ($recipient) = @_;\n> +\tif ($recipient =~ m/.*<[^>]*$/) {\n> +\t\tdie \"EEK!\"\n> +\t}\n> +\n\n\nMaybe this? Seems to work.\n\ndiff --git a/git-send-email.perl b/git-send-email.perl\nindex a0279de..52ddd9e 100755\n--- a/git-send-email.perl\n+++ b/git-send-email.perl\n@@ -374,15 +374,18 @@ my ($repoauthor, $repocommitter);\n # Verify the user input\n \n foreach my $entry (@to) {\n-\tdie \"Comma in --to entry: $entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Comma in --to entry: '$entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Invalid --to entry: '$entry'\\n\" unless $entry !~ m/.*<[^>]*$/;\n }\n \n foreach my $entry (@initial_cc) {\n-\tdie \"Comma in --cc entry: $entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Comma in --cc entry: '$entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Invalid --cc entry: '$entry'\\n\" unless $entry !~ m/.*<[^>]*$/;\n }\n \n foreach my $entry (@bcclist) {\n-\tdie \"Comma in --bcclist entry: $entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Comma in --bcclist entry: '$entry'\\n\" unless $entry !~ m/,/;\n+\tdie \"Invalid --bcclist entry: '$entry'\\n\" unless $entry !~ m/.*<[^>]*$/;\n }\n \n sub parse_address_line {\n"},{"id":"125546","messageId":"40aa078e0910201556h4757dbbdn853be4dd8aa920d0@mail.gmail.com","threadId":"21301","inReplyTo":"1256078917.2029.77.camel@Joe-Laptop.home","subject":"Re: git-send-email.perl defect: address missing trailing > accepted","fromName":"Erik Faye-Lund","fromEmail":"kusmabite@googlemail.com","sentAt":"2009-10-20T22:56:50Z","receivedAt":"2009-10-20T22:56:50Z","isPatch":false,"sender":{"key":"kusmabite@gmail.com","avatar":"https://avatars.githubusercontent.com/u/47073?v=4"},"body":"On Wed, Oct 21, 2009 at 12:48 AM, Joe Perches wrote:\n>> Something along these lines? Of course, the error message is, uhm,\n>> less than helpful :)\n>\n> Maybe this?  Seems to work.\n>\n\nDidn't my version work for you? It worked for me.\n\nI find it a bit cleaner to make it a part of the address-sanitizion,\nsince that needs to be performed for all addresses. I might miss\nsomething vital, though. I don't really speak perl all that well ;)\n\n\n-- \nErik \"kusma\" Faye-Lund\n"},{"id":"125547","messageId":"1256079633.2029.81.camel@Joe-Laptop.home","threadId":"21301","inReplyTo":"40aa078e0910201556h4757dbbdn853be4dd8aa920d0@mail.gmail.com","subject":"Re: git-send-email.perl defect: address missing trailing > accepted","fromName":"Joe Perches","fromEmail":"joe@perches.com","sentAt":"2009-10-20T23:00:33Z","receivedAt":"2009-10-20T23:00:33Z","isPatch":false,"sender":{"key":"joe@perches.com","avatar":"https://avatars.githubusercontent.com/u/13122723?v=4"},"body":"On Wed, 2009-10-21 at 00:56 +0200, Erik Faye-Lund wrote:\n> Didn't my version work for you? It worked for me.\n\nHi Erik.\n\nIt worked, but an unexplained die isn't great,\nso I put it where the other validations are done.\n\nIt seems that the regex for address validation\nisn't very good and perhaps there could/should\nbe a stronger validation done for each address\nentered.\n\ncheers, Joe\n"},{"id":"125550","messageId":"7vy6n5k5l0.fsf@alter.siamese.dyndns.org","threadId":"21301","inReplyTo":"1256079633.2029.81.camel@Joe-Laptop.home","subject":"Re: git-send-email.perl defect: address missing trailing > accepted","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2009-10-20T23:28:59Z","receivedAt":"2009-10-20T23:28:59Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Joe Perches writes:\n\n> It seems that the regex for address validation\n> isn't very good and perhaps there could/should\n> be a stronger validation done for each address\n> entered.\n\nThe existing ones are actually already harmful. It would trigger on a\nvalid addresses like this, wouldn't it?\n\n To: \"Hamano, Jun\" \n\nIt is worse than that.\n\nThe \"# Verify the user input\" block is in a wrong place in the codepath.\nAfter @to goes through this bogus \"verification\" step, it then is given to\nexpand_aliases(), which may expand to real addresses. And then they pass\nthrough sanitize_address() before getting used.\n\nThree implications that come from this wrong code structure are:\n\n (1) The stricter checks you added on top of the existing bogus\n verification step may prevent @to to reach expand_aliases() step,\n even if the tokens in @to may expand to correct addresses by this\n expand_aliases() step if they were allowed to reach here;\n\n (2) The result from expand_aliases() is never checked.\n\n (3) The result from sanitize_address() is not checked either.\n"}]}