Valid E-mails Rejected as Invalid

[Krellis]

I ran into a problem recently with sync_members. I was
attempting to add a list of addresses that included
"---<email address hidden>", but this address was rejected:

bin/sync_members -a=no -f
/usr/local/mailinglists/lists/system-status.txt
system-status
Invalid : ---<email address hidden>
You must fix the preceding invalid addresses first.

While this is an ODD address, it is perfectly legal,
per section 3.4 of RFC 2822
(http://www.faqs.org/rfcs/rfc2822.html). Rejecting a
valid address like this seems like a pretty major
problem to me.

This was with MailMan 2.1.6 on FreeBSD 4. If there is
any more information I can provide, please let me know.

Regards,
Tim Wilde

[http://sourceforge.net/tracker/index.php?func=detail&aid=1363422&group_id=103&atid=100103]

[Krellis (krellis)]

This appears to be a problem with line 210 of Utils.py, in
the ValidateEmail function:

    if _badchars.search(s) or s[0] == '-':
        raise Errors.MMHostileAddress, s

MailMan is explicitly rejecting e-mails that start with a
hyphen. Why? This is a perfectly legal e-mail address. If
MailMan is using e-mail addresses in such an unsafe way that
they could be interpreted as command line arguments, that's
just absurd. I can't see any other reason to forbid a
leading hyphen, though.

Can anyone tell me if I will be safe removing this check, or
if MailMan will blow up elsewhere?

[M-a (m-a)]

Mailman is not alone in rejecting messages that start with a
"-" - some MTAs also do that, for instance, Postfix (but see
Postfix's "allow_min_user" option).

The reason is that too many sites mistake such addresses for
sendmail command-line options, because most sendmail users
are clueless and forget the "--" before the addresses.

For that reason, it is rather unwise to use mail addresses
that start with a "-" - while legal, it's not universally
accepted.

[Mark Sapiro (msapiro)]

This was fixed in Mailman 2.1.18, but updating this bug was overlooked at the time.