Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix encoding of email addresses #489

Open
wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Conversation

rjbs
Copy link
Collaborator

@rjbs rjbs commented Apr 30, 2024

We saw cases where a user with the "real name" of Bob"Smith could cause problems in how we'd send them mail. This branch will fix that.

Previously, the code often naively formed To or From headers with code like this:

my $to_header = qq{"$asciiname" <$email>};

This worked most of the time. Given an $asciiname with " in it, though, it would break. Probably one that ended in \ would break, and probably other case. Also, it's much nicer to use people's full names, rather than ASCII!

We send our emails using Email::MIME. Email::MIME allows certain kinds of objects to be provided for certain kinds of headers. Notably, an Email::MIME::Header::AddressList object can be passed for To, From, Cc, Reply-To, and some others. This branch makes it much easier to get or create AddressList objects, and then uses them in most places where emails are created.

  • the PAUSE::Email library now exists, with methods for getting common addresses (internal reporting, contact-us, noreply) and for building new AddressLists
  • the PAUSE::MailAddress library, used to pick user email addresses, can now supply AddressList objects using properly encoded non-ASCII names
  • the various contact addresses in $Config are made clearer

@rjbs rjbs added bug email emails and reports we sent labels Apr 30, 2024
@rjbs rjbs self-assigned this May 1, 2024
@rjbs rjbs force-pushed the weird-email-bug branch 5 times, most recently from 4210d5a to 1ba904d Compare May 3, 2024 22:38
@rjbs
Copy link
Collaborator Author

rjbs commented May 3, 2024

The edit_cred pause_2017 test is failing. I can't really tell why. I'll look into it more sometime soon, but maybe somebody (charsbar… 😉) can tell.

I did edit lib/pause_2017/PAUSE/Web/Controller/User/Cred.pm so I will go read that first…

@rjbs rjbs force-pushed the weird-email-bug branch 4 times, most recently from 6fb897a to abc40d4 Compare May 4, 2024 02:13
@rjbs
Copy link
Collaborator Author

rjbs commented May 4, 2024

This may be ready for review…

@rjbs rjbs force-pushed the weird-email-bug branch 2 times, most recently from 197460c to 6f7b302 Compare May 4, 2024 14:47
@rjbs rjbs marked this pull request as ready for review May 4, 2024 14:47
@rjbs rjbs requested review from charsbar and wolfsage May 4, 2024 14:47
@rjbs rjbs changed the title fix quoting of email addresses fix encoding of email addresses May 4, 2024
rjbs added 10 commits May 11, 2024 20:34
ADMINS was an array reference.  CONTACT_ADDRESS is a single address.

We just use ['modules@perl.org'] as ADMINS, and do things like
interpolate it into strings, meaning that if we had two addresses, we
would get:

    Just email user@example.com other@example.mil

…which is weird.  Also, having to deal with joining the ADMINS arrayref
is just a pain.  Instead, make it one string!
ADMIN is the address that many emails are sent from.  Now that the code
will use this setting to make address objects, leaving it undef will not
do!  We get warnings.

CONTACT_ADDRESS is the setting where we usually put "modules@perl.org",
where we tell people to send the admins mail.  We will want to check
this in PAUSE daemon tests.
* admin_email_list - a List containing the emails in the ADMIN config
* email_list - given Email::Address::XS objects, make a List
* fromaddr_email_list - a List containing the email in the UPLOAD config
* is_valid_email - test whether a string is a single valid email address
There is a fair bit of rewriting here, hopefully making the code
clearer.  The most important part, though, is adding the
->email_header_object method, which will give us an Add object suitable
for passing into header constructors.
This is a test run for things to come.  In most places, we only use the
user email address, not their name.  But in some places, most especially
in paused, we use their name.

There were two problems there:

1. we were using the ASCII name, which we really don't need to do
2. we were not escaping any quotes (or anything else) in the name field,
   which could cause problems if someone puts a double quote in their
   fullname

It wasn't trivial to test and fix those locations because we don't
(yet!) have any tests for paused.  This introduces the use of fullname
to mldistwatch, using the new form: get the PAUSE::MailAddress for the
user, then use its ->email_header_object method to create a
Email::MIME::Header::AddressList.  We'll switch all the mailing to use
this, soon.
I could not yet remove Email::Address, because we use its $addr_spec,
which is easy, but not trivial, to replace.
rjbs added 7 commits May 11, 2024 20:34
UPLOAD will become NOREPLY_ADDRESS soon.
I don't know this code well, so this may be a bit of a wreck.

First, `$mgr->prepare_sendto` is updated.

1. prefer fullname to asciiname, because it is more polite
2. use real email header generation, not just concat
3. if we had "Bob <x@y>" and "Alice <x@y>" we now only send one email,
   not one per unique phrase; I think this is fine

Where the prepare_sendto code was basically duplicated, I have switched
things to use prepare_sendto.

Internal report emails now go to the internal reporting address, not the
public contact address.

In some places, the code was quite tough for me to read, so I just left
`$email` and the like used.  This should work fine.  It would be nice to
add phases later.

**I didn't understand this**: `$pause->{send_to}`.  That was being set
to a string, but I don't know really why or how it was used, although I
saw some hints.  The new code would've put ARRAY(0x1234) in that, so I
changed the text.  I will seek advice.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug email emails and reports we sent
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant