voodoodyne / subethasmtp

SubEtha SMTP is a Java library for receiving SMTP mail
Other
343 stars 138 forks source link

EmailUtils might incorrectly parse RFC3696 compliant email addresses #71

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
Hello, 

It seems to me that EmailUtils class might have problems with parsing RFC3696 
compliant e-mail addresses.

1) line 44:
   address = address.substring(1, address.indexOf('>'));

This line of code might lead to incorrect parsing of email address from smtp 
line if it contains ">" symbol, which is allowed in double quoted string or if 
it is escaped with "\" 
e.g "grigory>fadeev"@gmail.com

2) line 51:
   // find space (e.g. SIZE argument)
   int nextarg = address.indexOf(" ");

This line of code might lead to incorrect determination of space delimiter 
between email address and command parameter in case if address contains space, 
which is allowed if it is within quoted string or escaped by "\"
e.g "grigory fadeev"@gmail.com

3) line 65:
   int atIndex = email.lastIndexOf('@');

This line of code might lead to incorrect normalization of domain part, since 
it is allowed for email address to have more than one '@' characters.
e.g "grigory@fadeev"@gmail.com

It might be not a big problem since i doubt that somebody really use such 
address format, but anyway it would be good to fix this.
I would suggest following patch which fix mentioned problems, hope you'll find 
it helpful

PS Thanks for Subethasmtp library, it is really cool !! :)  

Original issue reported on code.google.com by grigory....@gmail.com on 12 Dec 2013 at 3:05

Attachments:

GoogleCodeExporter commented 9 years ago
Did not understand about line numbers and the code. Suppose you mean the 
patched code when quoting?

Original comment by revenf...@gmail.com on 12 Dec 2013 at 3:22

GoogleCodeExporter commented 9 years ago
3) line 65:
   int atIndex = email.lastIndexOf('@');

i've accidentally copy&pasted line from patched version 

Original comment by grigory....@gmail.com on 12 Dec 2013 at 3:23