Re: [PATCH] imap-send: increase command size limit

From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Apr 14, 2024, 17:44 UTC
Message-ID: <ZhwV6CmcC8zeSJ-7@tapette.crustytoothpaste.net>
In-Reply-To: <7026075c-db4e-4d43-bbd1-d2edb52da9b7@web.de>

On 2024-04-14 at 16:47:52, René Scharfe wrote:

Show 18 quoted lines

> nfvasprintf() has a 8KB limit, but it's not relevant, as its result is
> combined with other strings and added to a 1KB buffer by its caller.
> That 1KB limit is not mentioned in RFC 9051, which specifies IMAP.
> 
> While 1KB is plenty for user names, passwords and mailbox names,
> there's no point in limiting our commands like that.  Call xstrvfmt()
> instead of open-coding it and use strbuf to format the command to
> send, as we need its length.  Fail hard if it exceeds INT_MAX, because
> socket_write() can't take more than that.
> 
> Suggested-by: Jeff King <peff@peff.net>
> Signed-off-by: René Scharfe <l.s.r@web.de>
> ---
> This time I compiled with NO_CURL=1 and NO_APPLE_COMMON_CRYPTO=1 and
> verified with a silly printf that the changed code was actually used
> and wrote the present message to an IMAP folder whose name is 1006
> characters log, which required a 1026 bytes long APPEND command.  Yay,
> freedom!

I'm curious, is there a particular problem that you (or someone else) ran into that caused you to make this change? I agree it seems prudent in general, but if there's a particular real-world broken case that this hits (e.g., mailbox names in a given language), I think the commit message would be a great place to mention this real-world impact, which would lend support to your argument that this is a valuable change to make.

-- 
brian m. carlson (they/them or he/him)
Toronto, Ontario, CA