From: Junio C Hamano <gitster@pobox.com>
Date: Tue, 20 Oct 2009 23:28:59 GMT
Subject: Re: git-send-email.perl defect: address missing trailing > accepted
Message-ID: <7vy6n5k5l0.fsf@alter.siamese.dyndns.org>
In-Reply-To: <1256079633.2029.81.camel@Joe-Laptop.home>

Joe Perches <joe@perches.com> writes:

> It seems that the regex for address validation
> isn't very good and perhaps there could/should
> be a stronger validation done for each address
> entered.

The existing ones are actually already harmful.  It would trigger on a
valid addresses like this, wouldn't it?

    To: "Hamano, Jun" <gitster@pobox.com>

It is worse than that.

The "# Verify the user input" block is in a wrong place in the codepath.
After @to goes through this bogus "verification" step, it then is given to
expand_aliases(), which may expand to real addresses.  And then they pass
through sanitize_address() before getting used.

Three implications that come from this wrong code structure are:

 (1) The stricter checks you added on top of the existing bogus
     verification step may prevent @to to reach expand_aliases() step,
     even if the tokens in @to may expand to correct addresses by this
     expand_aliases() step if they were allowed to reach here;

 (2) The result from expand_aliases() is never checked.

 (3) The result from sanitize_address() is not checked either.