kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

send-email: make --suppress-cc=self sanitize input 

--suppress-cc=self fails to filter sender address in many cases where it
needs to be sanitized in some way, for example quoted:
"A U. Thor" <author@example.com>
To fix, make send-email sanitize both sender and the address it is
compared against.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Michael S. Tsirkin 2013-06-05 21:11:00 +03:00 committed by Junio C Hamano
parent d6ee44568c
commit da18759e86
1 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
git-send-email.perl
View File

@ -759,6 +759,11 @@ if (!defined $sender) {
$sender = $repoauthor || $repocommitter || ''; $sender = $repoauthor || $repocommitter || '';
} }


# $sender could be an already sanitized address
# (e.g. sendemail.from could be manually sanitized by user).
# But it's a no-op to run sanitize_address on an already sanitized address.
$sender = sanitize_address($sender);

my $prompting = 0; my $prompting = 0;
if (!@initial_to && !defined $to_cmd) { if (!@initial_to && !defined $to_cmd) {
my $to = ask("Who should the emails be sent to (if any)? ", my $to = ask("Who should the emails be sent to (if any)? ",
@ -1071,10 +1076,9 @@ sub send_message {
if ($cc ne '') { if ($cc ne '') {
$ccline = "\nCc: $cc"; $ccline = "\nCc: $cc";
} }
my $sanitized_sender = sanitize_address($sender);
make_message_id() unless defined($message_id); make_message_id() unless defined($message_id);


my $header = "From: $sanitized_sender my $header = "From: $sender
To: $to${ccline} To: $to${ccline}
Subject: $subject Subject: $subject
Date: $date Date: $date
@ -1091,7 +1095,7 @@ X-Mailer: git-send-email $gitversion
} }


my @sendmail_parameters = ('-i', @recipients); my @sendmail_parameters = ('-i', @recipients);
my $raw_from = $sanitized_sender; my $raw_from = $sender;
if (defined $envelope_sender && $envelope_sender ne "auto") { if (defined $envelope_sender && $envelope_sender ne "auto") {
$raw_from = $envelope_sender; $raw_from = $envelope_sender;
} }
@ -1292,8 +1296,9 @@ foreach my $t (@files) {
} }
elsif (/^From:\s+(.*)$/i) { elsif (/^From:\s+(.*)$/i) {
($author, $author_encoding) = unquote_rfc2047($1); ($author, $author_encoding) = unquote_rfc2047($1);
my $sauthor = sanitize_address($author);
next if $suppress_cc{'author'}; next if $suppress_cc{'author'};
next if $suppress_cc{'self'} and $author eq $sender; next if $suppress_cc{'self'} and $sauthor eq $sender;
printf("(mbox) Adding cc: %s from line '%s'\n", printf("(mbox) Adding cc: %s from line '%s'\n",
$1, $_) unless $quiet; $1, $_) unless $quiet;
push @cc, $1; push @cc, $1;
@ -1307,7 +1312,9 @@ foreach my $t (@files) {
} }
elsif (/^Cc:\s+(.*)$/i) { elsif (/^Cc:\s+(.*)$/i) {
foreach my $addr (parse_address_line($1)) { foreach my $addr (parse_address_line($1)) {
if (unquote_rfc2047($addr) eq $sender) { my $qaddr = unquote_rfc2047($addr);
my $saddr = sanitize_address($qaddr);
if ($saddr eq $sender) {
next if ($suppress_cc{'self'}); next if ($suppress_cc{'self'});
} else { } else {
next if ($suppress_cc{'cc'}); next if ($suppress_cc{'cc'});
@ -1354,7 +1361,8 @@ foreach my $t (@files) {
chomp; chomp;
my ($what, $c) = ($1, $2); my ($what, $c) = ($1, $2);
chomp $c; chomp $c;
if ($c eq $sender) { my $sc = sanitize_address($c);
if ($sc eq $sender) {
next if ($suppress_cc{'self'}); next if ($suppress_cc{'self'});
} else { } else {
next if $suppress_cc{'sob'} and $what =~ /Signed-off-by/i; next if $suppress_cc{'sob'} and $what =~ /Signed-off-by/i;
@ -1438,7 +1446,6 @@ foreach my $t (@files) {
sub recipients_cmd { sub recipients_cmd {
my ($prefix, $what, $cmd, $file) = @_; my ($prefix, $what, $cmd, $file) = @_;


my $sanitized_sender = sanitize_address($sender);
my @addresses = (); my @addresses = ();
open my $fh, "-|", "$cmd \Q$file\E" open my $fh, "-|", "$cmd \Q$file\E"
or die "($prefix) Could not execute '$cmd'"; or die "($prefix) Could not execute '$cmd'";
@ -1446,7 +1453,7 @@ sub recipients_cmd {
$address =~ s/^\s*//g; $address =~ s/^\s*//g;
$address =~ s/\s*$//g; $address =~ s/\s*$//g;
$address = sanitize_address($address); $address = sanitize_address($address);
next if ($address eq $sanitized_sender and $suppress_cc{'self'}); next if ($address eq $sender and $suppress_cc{'self'});
push @addresses, $address; push @addresses, $address;
printf("($prefix) Adding %s: %s from: '%s'\n", printf("($prefix) Adding %s: %s from: '%s'\n",
$what, $address, $cmd) unless $quiet; $what, $address, $cmd) unless $quiet;