in reply to How many security holes can you find?
Two related problems: Checks for e-mail address validity by looking for an '@' and a '.' and parses the user portion of the e-mail address by splitting at the first '@'.
The first is wrong because parsing an e-mail address is a lot harder than most people think. Now, because this is Perl, somebody mercifully wrapped up the hard part inside Mail::Valid (and other modules as well, but that's the one I usually use). Using that module will take you two lines, including the use statement.
For the second part, it is perfectly valid to have more than 1 '@' in an e-mail address (which goes back to the problems in parsing e-mail addresses). This is used to specify relays to put a message through. Admittedly, this is really a mis-feature that most MTAs no longer allow because it is too easy to use for spam.
The way you want to get the user portion of the address is to use Mail::Address's user() method. This will take a whopping three lines of Perl (gasp!).
----
I wanted to explore how Perl's closures can be manipulated, and ended up creating an object system by accident.
-- Schemer
Note: All code is untested, unless otherwise stated
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: How many security holes can you find?
by tanger (Scribe) on Apr 21, 2005 at 06:26 UTC |