public inbox for pbs-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Dominik Csapak <d.csapak@proxmox.com>
To: pbs-devel@lists.proxmox.com
Subject: [pbs-devel] [PATCH proxmox v3] fix #3302: allow for more characters for email
Date: Wed, 12 May 2021 16:20:16 +0200	[thread overview]
Message-ID: <20210512142016.3476-1-d.csapak@proxmox.com> (raw)

by removing the regex check here, that is responsibility of the caller

this is ok since we pass the args directly and not via shell, so
command injection should not be possible

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
tested command injection with emails like '--help' but this got sent
to '--help@myhostname' which got sent to 'root@myhostname'

 proxmox/src/tools/email.rs | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/proxmox/src/tools/email.rs b/proxmox/src/tools/email.rs
index b5d42c4..0b92a5b 100644
--- a/proxmox/src/tools/email.rs
+++ b/proxmox/src/tools/email.rs
@@ -16,23 +16,10 @@ pub fn sendmail(
     mailfrom: Option<&str>,
     author: Option<&str>,
 ) -> Result<(), Error> {
-    let mail_regex = regex::Regex::new(r"^[a-zA-Z\.0-9-]+@[a-zA-Z\.0-9-]+$").unwrap();
-
     if mailto.is_empty() {
         bail!("At least one recipient has to be specified!")
     }
-
-    for recipient in mailto {
-        if !mail_regex.is_match(recipient) {
-            bail!("'{}' is not a valid email address", recipient)
-        }
-    }
-
     let mailfrom = mailfrom.unwrap_or("root");
-    if !mailfrom.eq("root") && !mail_regex.is_match(mailfrom) {
-        bail!("'{}' is not a valid email address", mailfrom)
-    }
-
     let recipients = mailto.join(",");
     let author = author.unwrap_or("Proxmox Backup Server");
 
@@ -44,7 +31,7 @@ pub fn sendmail(
         .arg("-f")
         .arg(mailfrom)
         .arg("--")
-        .arg(&recipients)
+        .args(mailto)
         .stdin(Stdio::piped())
         .spawn()
     {
-- 
2.20.1





             reply	other threads:[~2021-05-12 14:20 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-12 14:20 Dominik Csapak [this message]
2021-05-12 19:20 ` [pbs-devel] applied: " Thomas Lamprecht

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210512142016.3476-1-d.csapak@proxmox.com \
    --to=d.csapak@proxmox.com \
    --cc=pbs-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal