bug#51733: 27.1; Detect impossible email addresses better

[Lars Ingebrigtsen]

Andreas Schwab <schwab@linux-m68k.org> writes:

> On Jan 19 2022, Lars Ingebrigtsen wrote:
>
>> Consider somebody sending you an email containing @", characters in the
>> name part, and then you decode the address, and then run the parsing
>> function.  The attacker would then have a wide attack surface to trick
>> the checker into checking the wrong parts of the address.
>
> Isn't that the whole point of textsec?

It's perfectly valid to have a

From: "larsi@example.com" <larsi@other.com>

address.  It's unambigious, and the responses will go to
larsi@other.com.

Of course, it's...  suspicious...  but not on the Unicode level.  (I'll
also be adding some non-Unicode bits to textsec, like

<a href="http://foo.bar";>http://other.bar</a>

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no