216191 - Multiline descriptions give Bugzilla email indigestion

Status: RESOLVED DUPLICATE of bug 101380

(Bugzilla :: Email Notifications, defect)

Description

[J. Paul Reed [:preed]]

From developers@:

however, in mozilla (and galeon), you can copy some multiline text and
paste that into the field. you can't do this in ie. this causes
problems, because most of the fields that get put into headers assume
only a single line. so you get email like this:

From: Patrick Tullmann <[e-mail]>
To: [e-mail]
Subject: [Bug 30210: ESX Server: vmkernel] Failed to get
Return-Path: <[e-mail]>
X-OriginalArrivalTime: 13 Aug 2003 21:20:26.0456 (UTC)
FILETIME=[B6D61D80:01C361E0]

Failed to get number of running VMs: -1
X-Bugzilla-Reason: Change

the actual summary was:

Failed to get
Failed to get number of running VMs: -1

This is to be expected when non-standard headers accidentally get put into
emails... most MTAs will dump the stuff they don't understand to below the last
header they do understand, so they themselves can add headers.

Marking security for now, since it would be possible for people to add email
headers this way, which is probably not necessarily a good thing (tm).

Comment 1

[J. Paul Reed [:preed]]

Couple of things I forgot:

Jonathan Schatz ([e-mail]) found this, and it affects 2.16.3 all the way
through the CVS tip.

Comment 2

[Jonathan Schatz]

couple more things:

>This is to be expected when non-standard headers accidentally get put into
>emails... most MTAs will dump the stuff they don't understand to below the last
>header they do understand, so they themselves can add headers.

it's not that. the real problem is that when you send email and you add in
headers like this:

X-Foo: bar
Subject: Subject

the headers are parsed until they find a line that doesn't start with
"Something:". Technically, i think they're supposed to look for 2 newlines to
seperate the headers from the body, but i think most mta's skip this part of the
rfc. 

Also, so far in my testing, this is only a problem with mozilla based browsers
in X11 environments. Konqueror and lynx seem to do the right thing. i don't have
access to any other browers to check this out in.

Comment 3

[Dave Miller [:justdave]]

After a short discussion in IRC, we decided this isn't a security bug.  Although
this does allow you to insert arbitrary headers into the outgoing email, it's
nothing you couldn't do by forging the entire email anyway, since email is such
a fragile system :)  Which basically makes this just an annoyance.

Comment 4

[Joel Peshkin]

Unloved bugs targetted for 2.18 but untouched since 9-15-2003 are being
retargeted to 2.20
If you plan to act on one immediately, go ahead and pull it back to 2.18.

Comment 5

[Marc Schumann [:Wurblzap]]

*** This bug has been marked as a duplicate of 101380 ***

Comment 6

[Dave Miller [:justdave]]

clearing target of DUPLICATE/WONTFIX/INVALID/WORKSFORME so they'll show up as
untriaged if they get reopened.