GNU bug report logs - #47616
27.1; hardening mail-envelope-from

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 47616 in the body.
You can then email your comments to 47616 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Francesco Potortì <pot <at> gnu.org>
To: bug-gnu-emacs <at> gnu.org
Subject: 27.1; hardening mail-envelope-from
Date: Tue, 06 Apr 2021 14:42:41 +0200

in mail-utils.el the function mail-fetch-field thus notes in the doc
string:

  The buffer should be narrowed to just the header, else false
  matches may be returned from the message body.

In fact, both sendmail-send-it and smtp-send-it use mail-envelope-from,
which calls mail-fetch-field without narrowing, which in fact causes a
false match if:

- you forward a message with "From: " at begining of line
- message-forward-as-mime is nil
- mail-specify-envelope-from is t
- mail-envelope-from is 'header

In this case, both sendmail-send-it and smptmail-send-it try to see if
they should set the From: field and the sender, and both get a false
match from mail-envelope-from.

Apparently, the problem with sendmail-send-it is corrected later in the
code (I don't know where) so the mail is sent correctly, which is why I
had never realised this until I started using smtpmail-send-it, which
sets a wrong From: header copied from the forwarded message.

Hardening mail-envelope-from from sendmail.el by narrowing to the
headers, as the doc says, corrects the problem that I observed.

(defun mail-envelope-from ()
  "Return the envelope mail address to use when sending mail.
This function uses `mail-envelope-from'."
  (or (if (eq mail-envelope-from 'header)
	  (nth 1 (mail-extract-address-components
		  (save-restriction
		    (save-excursion
		      (goto-char (point-max))
		      (re-search-backward
		       (concat "^" (regexp-quote mail-header-separator) "\n")
		       nil t)
		      (narrow-to-region (point-min) (point))
		      (mail-fetch-field "From")))))
	mail-envelope-from)
      user-mail-address))

This introduces a small semantic change for the meaning of the
mail-envelope-from variable.  Currently, the docs says:

If non-nil, designate the envelope-from address when sending mail.
This only has an effect if `mail-specify-envelope-from’ is non-nil.
The value should be either a string, or the symbol `header’ (in
which case the contents of the "From" header of the message
being sent is used), or nil (in which case the value of
‘user-mail-address’ is used).

The last two lines should be instead:

...
being sent is used, if one exists).  If the value is nil, or if it is
`header' and no "From" header is found in the message, the value of
‘user-mail-address’ is used.

Message #8 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Francesco Potortì <pot <at> gnu.org>
To: bug-gnu-emacs <at> gnu.org
Subject: Re: 27.1; hardening mail-envelope-from
Date: Wed, 07 Apr 2021 17:05:57 +0200

>(defun mail-envelope-from ()
>  "Return the envelope mail address to use when sending mail.
>This function uses `mail-envelope-from'."
>  (or (if (eq mail-envelope-from 'header)
>	  (nth 1 (mail-extract-address-components
>		  (save-restriction
>		    (save-excursion
>		      (goto-char (point-max))
>		      (re-search-backward
>		       (concat "^" (regexp-quote mail-header-separator) "\n")
>		       nil t)
>		      (narrow-to-region (point-min) (point))
>		      (mail-fetch-field "From")))))
>	mail-envelope-from)
>      user-mail-address))

This one is better (I had forgotten about mail-header-end)

(require 'sendmail)
(defun mail-envelope-from ()
  "Return the envelope mail address to use when sending mail.
This function uses `mail-envelope-from'."
  (or (if (eq mail-envelope-from 'header)
	  (let ((from-field (save-restriction
			      (narrow-to-region (point-min) (mail-header-end))
			      (mail-fetch-field "From"))))
	    (when from-field
	      (nth 1 (mail-extract-address-components from-field))))
	mail-envelope-from)
      user-mail-address))

Message #11 received at 47616 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Francesco Potortì <pot <at> gnu.org>
Cc: 47616 <at> debbugs.gnu.org
Subject: Re: bug#47616: 27.1; hardening mail-envelope-from
Date: Thu, 06 May 2021 12:22:53 +0200

Francesco Potortì <pot <at> gnu.org> writes:

> Hardening mail-envelope-from from sendmail.el by narrowing to the
> headers, as the doc says, corrects the problem that I observed.

Thanks -- I don't think we should change mail-envelope-from itself here,
because it may conceivably be called from other contexts.  Instead the
callers in sendmail/smtpmail should be altered to narrow to the headers
before calling it, and I've now done this in Emacs 28.  (This uncovered
a similar bug in smtpmail.el, too.)

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #18 received at 47616 <at> debbugs.gnu.org (full text, mbox):

From: Francesco Potortì <pot <at> gnu.org>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: 47616 <at> debbugs.gnu.org
Subject: Re: bug#47616: 27.1; hardening mail-envelope-from
Date: Thu, 06 May 2021 14:16:29 +0200

>Francesco Potortì <pot <at> gnu.org> writes:
>> Hardening mail-envelope-from from sendmail.el by narrowing to the
>> headers, as the doc says, corrects the problem that I observed.
>
>Thanks -- I don't think we should change mail-envelope-from itself here,
>because it may conceivably be called from other contexts.  Instead the
>callers in sendmail/smtpmail should be altered to narrow to the headers
>before calling it, and I've now done this in Emacs 28.  (This uncovered
>a similar bug in smtpmail.el, too.)

That makes sense, in principle.  I would argue for adding a comment to
mail-envelope-from stating that since it calls mail-fetch-field it
should be called only after narrowing to the headers.  Or maybe even
adding a note in the doc string, as done in mail-fetch-field.

Message #21 received at 47616 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Francesco Potortì <pot <at> gnu.org>
Cc: 47616 <at> debbugs.gnu.org
Subject: Re: bug#47616: 27.1; hardening mail-envelope-from
Date: Fri, 07 May 2021 13:17:27 +0200

Francesco Potortì <pot <at> gnu.org> writes:

> That makes sense, in principle.  I would argue for adding a comment to
> mail-envelope-from stating that since it calls mail-fetch-field it
> should be called only after narrowing to the headers.  Or maybe even
> adding a note in the doc string, as done in mail-fetch-field.

Good idea.  I've now mentioned this in the doc string in Emacs 28.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Message #24 received at 47616 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: pot <at> gnu.org, 47616 <at> debbugs.gnu.org
Subject: Re: bug#47616: 27.1; hardening mail-envelope-from
Date: Fri, 07 May 2021 14:33:03 +0300

> From: Lars Ingebrigtsen <larsi <at> gnus.org>
> Date: Fri, 07 May 2021 13:17:27 +0200
> Cc: 47616 <at> debbugs.gnu.org
> 
> Francesco Potortì <pot <at> gnu.org> writes:
> 
> > That makes sense, in principle.  I would argue for adding a comment to
> > mail-envelope-from stating that since it calls mail-fetch-field it
> > should be called only after narrowing to the headers.  Or maybe even
> > adding a note in the doc string, as done in mail-fetch-field.
> 
> Good idea.  I've now mentioned this in the doc string in Emacs 28.

Did you forget to push?

Message #27 received at 47616 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: pot <at> gnu.org, 47616 <at> debbugs.gnu.org
Subject: Re: bug#47616: 27.1; hardening mail-envelope-from
Date: Fri, 07 May 2021 14:09:28 +0200

Eli Zaretskii <eliz <at> gnu.org> writes:

> Did you forget to push?

Yup.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.