bug#51733: 27.1; Detect impossible email addresses better

[Lars Ingebrigtsen]

Andreas Schwab <schwab@linux-m68k.org> writes:

> The why not allow to run the textsec on the decoded header directly?

Consider somebody sending you an email containing @", characters in the
name part, and then you decode the address, and then run the parsing
function.  The attacker would then have a wide attack surface to trick
the checker into checking the wrong parts of the address.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no