Subject: | Miss-handling null "<>" email addresses |
Date: | Tue, 22 Oct 2013 17:34:27 +0200 |
To: | bug-MailTools [...] rt.cpan.org, bug-AnyEvent-SMTP [...] rt.cpan.org |
From: | Thorben Jändling <thorben.jaendling [...] switch.ch> |
Good day,
While trying to debug a SMTP conversation similar to the one that
follows, I beleive that I have found a bug in Mail::Address (or in
AnyEvent::SMTP's use of Mail::Address' parse() method):
$ telnet my-mta 25
Trying x.x.x.x...
Connected to my-mta.
Escape character is '^]'.
220 my-mta AnyEvent::SMTP Ready.
ehlo me
250 Go on.
mail from:<>
501 Usage: MAIL FROM:<mail addr>
quit
221 Bye.
Connection to my-mta closed by foreign host.
$
It is quite common, in the real world, to have no sender address. In
such cases the null address "<>" is given. (Note "Mail from: \n" ie no
<> is invalid and should error).
In AnyEvent::SMTP::Server the 'mail from' handler has the following two
lines:
my @addrs = map { $_->address } Mail::Address->parse($from);
@addrs == 1 or return $con->reply('501 Usage: MAIL FROM:<mail addr>');
However in the case of <> Mail::Address->parse returns an empty array;
causing the SMTP conversation to incorrectly fail.
Maybe AnyEvent::SMTP::Server should not be using this parse() method, or
handle the <> case on its own. However my feeling is that parse should
return a one element array, and the element should represent the null
address (e.g. either "" or undef)
Looking at Mail::Addess::parse(): It tokenises the string, but does not
consider the case where there is no other token between < and >, ie:
for(my $idx = 0; $idx < $len; $idx++)
{
$_ = $tokens->[$idx];
if(substr($_,0,1) eq '(') { push @comment, $_ }
elsif($_ eq '<') { $depth++ }
elsif($_ eq '>') { $depth-- if $depth }
elsif($_ eq ',' || $_ eq ';')
{ ...
}
elsif($depth) { push @address, $_ }
...
}
The "elsif($depth)" will never be reached, thus the address array
remains empty.
I would suggest fixing the if/elsif logic or having _tokonise() add an
element in the token array between < and >, maybe undef or ""; if there
is no other token between them.
Regards,
Thorben
--
Thorben Jändling - Security Engineer: +41 44 268 1576
SWITCH Security: cert@switch.ch +41 44 268 1540
http://www.switch.ch/all/cert/contact