Re: [PATCH v2] send-email: provide whitelist of SMTP AUTH mechanisms

> On Sun, Aug 2, 2015 at 2:57 PM, Eric Sunshine <sunshine@sunshineco.com> wrote:
>> On Sun, Aug 2, 2015 at 12:42 PM, Jan Viktorin <viktorin@rehivetech.com> wrote:
>>> @@ -1136,6 +1141,10 @@ sub smtp_auth_maybe {
>>>                 Authen::SASL->import(qw(Perl));
>>>         };
>>>
>>> +       if($smtp_auth !~ /^(\b[A-Z0-9-_]{1,20}\s*)*$/) {
>>> +               die "invalid smtp auth: '${smtp_auth}'";
>>> +       }
>>
>> Style: space after 'if'
>
> By the way, I notice that Authen::SASL::Perl implementation itself
> normalizes the incoming mechanism to uppercase, if necessary:
>
>     $mechanism =~ s/^\s*\b(.*)\b\s*$/$1/g;
>     $mechanism =~ s/-/_/g;
>     $mechanism =  uc $mechanism;
>
> Since it doesn't require uppercase, it's not clear how much benefit
> there is to adding a strict regex check to git-send-email.