net/mail: comments in display names are incorrectly handled

[rolandshoemaker]

In #21018, it was noted that parentheses in display names were rejected, which
resulted in a confusing error.

The solution was to introduce a behavior which diverged relatively significantly
from RFC 5322 in CL50911, allowing special reserved characters to appear in the
"atom" syntax, where they are disallowed by the specification.

One of the consequences of this change was that we introduced non-compliant
handling of comments (text within parentheses) within display names. Parsing
Hello (comment) there <hello@example.com> should result in a display name of
Hello there, but because we (a) allow special characters (in this case parentheses)
in the "atom" syntax and (b) don't properly handle comments in display names, we
parse a name of Hello (comment) there which is clearly non-conformant.

I believe we should revert CL50911, rather than just removing parentheses from
the allowed set of specials, since it's unclear why this was done to begin with,
and there is no evidence this is useful or needed.

We should additionally support the obs-phrase syntax in dispaly names, which
permit comments, and properly handle them.

Becuase this introduces a parser misalignment, which could plausibly result in
different trust decisions being made by programs using different parsers, we're
considering this a PUBLIC track security issue (per the Go Security Policy).

Thanks to Juho Nurminen of Mattermost for reporting this issue, and @Slonser for
also independently reporting this issue.

[gopherbot]

Change https://go.dev/cl/555596 mentions this issue: net/mail: properly handle special characters in phrase and obs-phrase

[Slonser]

One of the attack vectors is address spoofing

package main

import (
	"fmt"
	"net/mail"
)

func main() {
	addressListString := "(<evil@gmail.com>,) <sevakokorin80@gmail.com>"

	addressList, err := mail.ParseAddressList(addressListString)
	if err != nil {
		fmt.Println("Error parsing address list:", err)
		return
	}

	for _, addr := range addressList {
		fmt.Printf("Name: %s, Address: %s\n", addr.Name, addr.Address)
	}
}

Output:

Name: (, Address: evil@gmail.com
Name: ), Address: sevakokorin80@gmail.com

[neild]

@gopherbot please open backport issues, this is a PUBLIC track security fix

[gopherbot]

Backport issue(s) opened: #65848 (for 1.21), #65849 (for 1.22).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/566195 mentions this issue: [release-branch.go1.21] net/mail: properly handle special characters in phrase and obs-phrase

[gopherbot]

Change https://go.dev/cl/566215 mentions this issue: [release-branch.go1.22] net/mail: properly handle special characters in phrase and obs-phrase

[neild]

Assigned this CVE-2024-24784.