From: Joe Perches <joe@perches.com>
Date: Wed, 20 Apr 2011 22:45:11 GMT
Subject: Re: [RFC PATCH] git-send-email: Validate recipient_cmd (to-cmd, cc-cmd) addresses
Message-ID: <1303339511.24766.41.camel@Joe-Laptop>
In-Reply-To: <BANLkTikuC1V1U-c0wyThOZAn6gVXr7S_cQ@mail.gmail.com>

On Thu, 2011-04-21 at 00:29 +0200, Ævar Arnfjörð Bjarmason wrote:
> On Wed, Apr 20, 2011 at 23:50, Joe Perches <joe@perches.com> wrote:
> > +       my ($recipient_name, $recipient_addr) = ($recipient =~ /^\s*(.*?)\s*(<[^>]+>)/);
> In Perl you can write (<.*?>) instead of (<[^>]+>)

Hey Ævar.  That matches <>.  Not a good email address.

This is what linux/scripts/get_maintainers.pl uses:

sub parse_email {
    my ($formatted_email) = @_;

    my $name = "";
    my $address = "";

    if ($formatted_email =~ /^([^<]+)<(.+\@.*)>.*$/) {
	$name = $1;
	$address = $2;
    } elsif ($formatted_email =~ /^\s*<(.+\@\S*)>.*$/) {
	$address = $1;
    } elsif ($formatted_email =~ /^(.+\@\S*).*$/) {
	$address = $1;
    }

    $name =~ s/^\s+|\s+$//g;
    $name =~ s/^\"|\"$//g;
    $address =~ s/^\s+|\s+$//g;

    if ($name =~ /[^\w \-]/i) {  	 ##has "must quote" chars
	$name =~ s/(?<!\\)"/\\"/g;       ##escape quotes
	$name = "\"$name\"";
    }

    return ($name, $address);
}

There's probably some weakness in that.

> If this program doesn't have some extract_emails_from_string()
> function already it probably should.

Maybe it does.  It currently uses "sanitize_address".