Skip Menu |
 

This queue is for tickets about the MailTools CPAN distribution.

Report information
The Basics
Id: 16917
Status: resolved
Priority: 0/
Queue: MailTools

People
Owner: Nobody in particular
Requestors: ntyni [...] iki.fi
Cc:
AdminCc:

Bug Information
Severity: Normal
Broken in: 1.67
Fixed in: (no value)



Subject: Mail::Address taints its data due to 'use locale'
Download (untitled) / with headers
text/plain 777b
Hi, Mail::Address taints its data. Consider: #!/usr/bin/perl -wT use strict; use Scalar::Util qw(tainted); use Mail::Address; my @a = map { $_->address } Mail::Address->parse('user@domain.invalid'); warn("tainted: $a[0]") if tainted($a[0]); This outputs tainted: user@domain.invalid at ./a.pl line 8. for me on Perl 5.8.4 and 5.8.7 on Debian GNU/Linux. Clearly the input data was not tainted here, but the output is. This happens because Mail::Address has 'use locale' in effect, and the regexps at the end of _tokenise(), lines 122-125, match for whitespace (\s). This taints the data as documented in the perllocale document. I don't have a good patch, but this is unexpected behaviour and I think it should be at least documented. Cheers, -- Niko Tyni ntyni@iki.fi
Download (untitled) / with headers
text/plain 703b
Yes, locale is the cause. I got this question some time ago as well, and couldn't think of any good reason to have locale support in the module. E-mail simply is ASCII. IMO it is a relict of the first attempts to support Unicode with Perl, in the old days when Graham Barr was still maintainer of this module. It may cause unexpected behavior for the average module user. Besides, Mail::Address doesn't support charset-encodings well enough, so shouldn't try unicode/locales in the first place. With the chance that some rare applications may break a little, I will remove this 'use locale'. Is was already away in my working version of the module, but now also released to CPAN (MailTools-v1.68)


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.