parts of recipients adresses between square brackets in are interpreted as seperate addresses

Bug #680447 reported by Frank Van Damme
This bug affects 1 person
Affects Status Importance Assigned to Milestone
GNU Mailman
Mark Sapiro

Bug Description

We use max_num_recipients as a vague spam detector and came to the conclusion that when counting, extra addresses are counted if an address contains [square brackets]. Example:

<email address hidden>, jefke [<email address hidden>], <email address hidden>, <email address hidden>

in the To: or Cc: field will be counted as 6 adresses. I reckon this is interpreted as an array and flattened or something.

(Yes, []'s are illegal in mail adresses but we receive messages like that anyway).

Proposed solution: 's/\]/\\]/g' 's/\[/\\[/g'

Revision history for this message
Mark Sapiro (msapiro) wrote :

There's not much Mailman can easily do about this. The issue is in the Python email library. email.utils.getaddresses() is used by Mailman to get a list of addresses and the length of that list is used as the number of recipients. getaddresses() treats the brackets as a kind of delimiter. Thus, email.utils.getaddresses(['jefke [<email address hidden>]']) returns this list of (name, address) tuples [('', 'jefke'), ('', ''), ('', '<email address hidden>'), ('', '')] of length 4 instead of the list [('jefke', '<email address hidden>')] of length 1 that you expect.

Escaping the brackets as you suggest changes the result only in that a '\' is appended to the <email address hidden> address returned in the third tuple.

Changed in mailman:
assignee: nobody → Mark Sapiro (msapiro)
importance: Undecided → Low
status: New → Won't Fix
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers