search

jstedfast / gmime

A C/C++ MIME creation and parser library with support for S/MIME, PGP, and Unix mbox spools.
GNU Lesser General Public License v2.1
113 stars 36 forks source link

GMime 3.2 Parser missing broken Address Specification #95

Closed albrechtd closed 4 years ago

albrechtd commented 4 years ago

GMime 3.2.7 will accept a header looking like

From: Sender <me@example.com >

without throwing a parser warning (try e.g. examples/msgcheck). I noticed such headers in several malware/spam messages, apparently created by broken scripts or something similar.

If I understand RFC 5322 correctly, the whitespace between the addr-spec and the “>” is not allowed, though (a folding whitespace would be, but this isn't one):

angle-addr      =   [CFWS] "<" addr-spec ">" [CFWS]
addr-spec       =   local-part "@" domain
domain          =   dot-atom / domain-literal / obs-domain
dot-atom        =   [CFWS] dot-atom-text [CFWS]
dot-atom-text   =   1*atext *("." 1*atext)

Or did I miss something here?

jstedfast commented 4 years ago

All (ascii) whitespace is CFWS, you don't actually need a newline for it to be CFWS.

albrechtd commented 4 years ago

Ah! Reading RFC 5322 more closely, you're right, of course!

Sorry for the noise & thanks for the clarification…

Best, Albrecht.