Page MenuHomePhabricator

MailAddress needs to be quoting the name part of the mail headers.
Closed, ResolvedPublic

Description

When there is white space present in the user name("Abuse Filter", "Wiki Admin") for an user then it will break email headers if not contained in double quotes. The safest way is to just always wrap the name in double quotes and not selectively.

https://gerrit.wikimedia.org/r/#/c/425433/

Event Timeline

Alexia created this task.Apr 10 2018, 10:15 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 10 2018, 10:15 PM

I updated the test to match the new conditions.

Change 425433 had a related patch set uploaded (by Alexia; owner: Alexia):
[mediawiki/core@master] MailAddress should always be quoting the name otherwise whitespace in the username will break break email headers.

https://gerrit.wikimedia.org/r/425433

What software requires it to be quoted? I just created "Lego test account number 1" and sent email to and from that account with no issues. The raw headers looked like To: Lego test account number 1 <email> and Reply-To: Lego test account number 1 <email>. Both displayed fine in Thunderbird, and presumably went through Wikimedia's mail setup properly.

I will fix this patch this week.

What software requires it to be quoted? I just created "Lego test account number 1" and sent email to and from that account with no issues. The raw headers looked like To: Lego test account number 1 <email> and Reply-To: Lego test account number 1 <email>. Both displayed fine in Thunderbird, and presumably went through Wikimedia's mail setup properly.

It was an issue that came up with AWS Simple Email Service that was made worse with an older version of sendmail. The headers were:

To: User Space <userspace@example.com>
Reply-To: Help <help@example.com>

It would end up parsing the To: header as: "To: User Space userspace@example.com Reply-To Help <help@example.com>"

Obviously that should not happen, but after spending too much time reading the RFCs I eventually settled on there be implementation issues in software out of my control. The CRLF present in the headers should have noted the end of the To: header to the parser. I went with the always quote the name in the email approach since it fixed the issue in all cases.

If I remember correctly this is the relevant RFC section: https://tools.ietf.org/html/rfc5322#section-3.2.1

Krinkle moved this task from Backlog to Core on the MW-1.31-release board.Apr 18 2018, 6:08 PM

Change 425433 merged by jenkins-bot:
[mediawiki/core@master] mail: Always quote uncoded names in MailAddress

https://gerrit.wikimedia.org/r/425433

Legoktm closed this task as Resolved.Apr 26 2018, 5:11 AM
Legoktm claimed this task.
Legoktm reassigned this task from Legoktm to Alexia.

It was an issue that came up with AWS Simple Email Service that was made worse with an older version of sendmail.

Thank you for explaining, and the patch!

Change 429129 had a related patch set uploaded (by Legoktm; owner: Alexia):
[mediawiki/core@REL1_31] mail: Always quote uncoded names in MailAddress

https://gerrit.wikimedia.org/r/429129

Change 429129 merged by jenkins-bot:
[mediawiki/core@REL1_31] mail: Always quote uncoded names in MailAddress

https://gerrit.wikimedia.org/r/429129