#29837: Allow email sending with a newline in the subject
-------------------------------+--------------------------------------
Reporter: Álex Córcoles | Owner: nobody
Type: New feature | Status: closed
Component: Core (Mail) | Version: 2.1
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Changes (by Carlton Gibson):
* status: new => closed
* resolution: => invalid
Comment:
Hmmm. I seem to recall that allowing newlines leads to dangers of email
injection attacks… (I’d need to look that up).
[https://tools.ietf.org/html/rfc2822.html#section-2.2.3 RFC 2822 section
2.2.3] says:
>The process of moving from this folded multiple-line representation
>of a header field to its single line representation is called
>"unfolding". Unfolding is accomplished by simply removing any CRLF
>that is immediately followed by WSP. Each header field should be
>treated in its unfolded form for further syntactic and semantic
>evaluation.
i.e. I think you’re meant to remove the newlines before resending the
email.
I’m going to close on that basis.
--
Ticket URL: <https://code.djangoproject.com/ticket/29837#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.fd6dfbb54f2ebe115a7d5218175cef35%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
