From 612b58dd595f42c15e6d406cf7e8e030c8461f01 Mon Sep 17 00:00:00 2001 From: Vincent Breitmoser Date: Thu, 5 Nov 2020 12:11:02 +0100 Subject: [PATCH] mail: hotfix for lettre issue --- database/src/types.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/database/src/types.rs b/database/src/types.rs index 817a563..46dfa38 100644 --- a/database/src/types.rs +++ b/database/src/types.rs @@ -40,6 +40,11 @@ impl TryFrom<&UserID> for Email { let domain = idna::domain_to_ascii(domain) .map_err(|e| anyhow!("punycode conversion failed: {:?}", e))?; + // TODO this is a hotfix for a lettre vulnerability. remove once fixed upstream. + if localpart.starts_with("-") { + return Err(anyhow!("malformed email address: '{:?}'", uid.value())); + } + // Join. let address = format!("{}@{}", localpart, domain); @@ -205,4 +210,10 @@ mod tests { assert_eq!(c("Foo@example.org").as_str(), "foo@example.org"); assert_eq!(c("foo@EXAMPLE.ORG").as_str(), "foo@example.org"); } + + #[test] + fn email_vuln() { + assert!(Email::from_str("foo <-@EXAMPLE.ORG>").is_err()); + assert!(Email::from_str("-@EXAMPLE.ORG").is_err()); + } }