[Raw Msg Headers][Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: why does smtpserver restrict quote in argument to router for verification



It's fine as far as RFC821 goes too.  Besides, even if you did escape the
quote, the code in the smtpserver isn't looking for that -- it's just checking
for the presence of a single quote anywhere in the address.

Perhaps it was intended to be a reverse-quote?  Perhaps it is trying to guard
against something like
	MAIL FROM:<`/bin/halt`>
managing to get the string executed as it is "read" by some part of the router
zsh code?

Here's the BNF that applies to the address:

<reverse-path> ::= <path>
<path> ::= "<" [ <a-d-l> ":" ] <mailbox> ">"
<mailbox> ::= <local-part> "@" <domain>
<local-part> ::= <dot-string> | <quoted-string>
<dot-string> ::= <string> | <string> "." <dot-string>
<string> ::= <char> | <char> <string>
<char> ::= <c> | "\" <x>
<c> ::= any one of the 128 ASCII characters, but not any
          <special> or <SP>
<special> ::= "<" | ">" | "(" | ")" | "[" | "]" | "\" | "."
                      | "," | ";" | ":" | "@"  """ | the control
                      characters (ASCII codes 0 through 31 inclusive and
                      127)

Notice that <special> does NOT include a single quote mark, therefore there is
no requirement to escape the quote mark in Shawn_O'Malley@mc.xerox.com.

					\nick