modperl-randall_schwartz_down_on_cheesy_email_address_untainting

This is part of The Pile, a partial archive of some open source mailing lists and newsgroups.



To: Roger Espel Llima <espel@iagora.net>
Cc: modperl@apache.org
Subject: Re: open(FH,'|qmail-inject') fails
From: merlyn@stonehenge.com (Randal L. Schwartz)
Date: 07 Sep 2000 13:25:21 -0700

>>>>> "Roger" == Roger Espel Llima <espel@iagora.net> writes:

Roger>   # limit allowed characters in email addresses
Roger>   $to =~ tr/-a-zA-Z0-9_+%$.,:!@=()[]//cd;

This is neither necessary nor sufficient.  Please stop with this nonsense.

**************************************************
*
*  An email address can have ANY CHARACTER OF THE PRINTABLE ASCII SEQUENCE.
*
*  An email address NEVER NEEDS TO GET NEAR A SHELL, so ALL CHARACTERS
*  ARE SAFE.
*
**************************************************

Clear?

Man, if I see ONE MORE script that checks for a "legal email", I'm gonna
scream.  Matter of fact, I already did. :)

===

Date: Mon, 11 Sep 2000 16:39:50 +0200
From: "Alexander Farber (EED)" <eedalf@eed.ericsson.se>
Subject: [OT] Re: open(FH,'|qmail-inject') fails

"Randal L. Schwartz" wrote:
> Man, if I see ONE MORE script that checks for a "legal email",
> I'm gonna scream.  Matter of fact, I already did. :)

I screamed when I've seen the correct version too :-) It is at
http://public.yahoo.com/~jfriedl/regex/code.html and the regex
for URL's is at http://foad.org/~abigail/Perl/url2.html

===

Date: Mon, 11 Sep 2000 07:58:55 -0700
To: "Alexander Farber (EED)" <eedalf@eed.ericsson.se>
From: Bill Moseley <moseley@hank.org>
Subject: Re: [OT] Re: open(FH,'|qmail-inject') fails
Cc: modperl@apache.org

At 04:39 PM 09/11/00 +0200, Alexander Farber (EED) wrote:
>"Randal L. Schwartz" wrote:
>> Man, if I see ONE MORE script that checks for a "legal email",
>> I'm gonna scream.  Matter of fact, I already did. :)
>
>I screamed when I've seen the correct version too :-) It is at
>http://public.yahoo.com/~jfriedl/regex/code.html and the regex
>for URL's is at http://foad.org/~abigail/Perl/url2.html

Did you see this of Abigail's?

http://x58.deja.com/getdoc.xp?AN=531471039

===

To: Bill Moseley <moseley@hank.org>
Cc: "Alexander Farber (EED)" <eedalf@eed.ericsson.se>, modperl@apache.org
Subject: Re: [OT] Re: open(FH,'|qmail-inject') fails
From: merlyn@stonehenge.com (Randal L. Schwartz)
Date: 11 Sep 2000 08:04:26 -0700

>>>>> "Bill" == Bill Moseley <moseley@hank.org> writes:

Bill> Did you see this of Abigail's?

Bill> http://x58.deja.com/getdoc.xp?AN=531471039

Yeah, that's already in the CPAN at RFC::RFC822::Address, just a
different way of doing it from Email::Valid.

===


the rest of The Pile (a partial mailing list archive)

doom@kzsu.stanford.edu