70573 - ".\n" in comments not escaped

Status: VERIFIED DUPLICATE of bug 117055

(Bugzilla :: Creating/Changing Bugs, defect, P2)

Description

[Ben Bucksch (:BenB)]

If you write only a dot in the comment field, the bugmail contains no comment at
all. I wondered, why this is the case. A possible explanation is this bug.

The SMTP standard says that a dot on its own line ends the data of a msg. After
that, commands follow again. So, you might be able to place a dot and after that
SMTP command in a comment and make bugzilla issue them to the SMTP server.
Possible security bug.

Test:
.
SOME SMTP COMMAND HERE
MAIL FROM [e-mail]
RCPT TO [e-mail]
DATA
hi
.

Comment 1

[Ben Bucksch (:BenB)]

The last line of the bugmail for the above was "Test:". I did not get any other
mail. So, doesn't seem to be a security bug.

Another test:
.
MAIL FROM [e-mail]
RCPT TO [e-mail]
DATA
hi
.

Comment 2

[Stephan Niemz]

Maybe the patch in bug 65101 fixes this?
Just a guess, but adding dependency.  Please remove it if I'm wrong.

Comment 3

[Dave Miller [:justdave]]

Test...
.
RSET
MAIL FROM:<[e-mail]>
RCPT TO:<[e-mail]>
DATA
From: Dave <[e-mail]>
To: Dave <[e-mail]>
Subject: This is a test

This is a test.

Comment 4

[Dave Miller [:justdave]]

Hmm, we're using sendmail -t, and not SMTP for this, which is why the SMTP 
commands aren't doing anything.  sendmail -t exits when it gets a period on a 
line by itself, which means the rest of it is just dumped.  Removing 2.14 
designation since this is definitely not a security issue.  I agree that the 
patch on bug 65101 would fix this.  (It would also remove one more 
incompatibility with Win32, too, which although I couldn't care less about 
windows, is still a bonus. :)

Comment 5

[Jacob Steenhagen]

*** Bug 73420 has been marked as a duplicate of this bug. ***

Comment 6

[Ben Bucksch (:BenB)]

Jesse :-). even freaky bugs get dups :).

Comment 7

[Andreas Franke (gone)]

-> Bugzilla product, Changing Bugs component, reassigning.

Comment 8

[Gervase Markham [:gerv]]

This ain't gonna be fixed outside of bug 65101.

Gerv

*** This bug has been marked as a duplicate of 65101 ***

Comment 9

[Dave Miller [:justdave]]

clearing milestone for invalid/wontfix/worksforme/duplicate so they'll show up
as untriaged if they get reopened.

Comment 10

[Dave Miller [:justdave]]

dupe of wrong bug...

Comment 11

[Dave Miller [:justdave]]

117055 is newer, but had a patch, and actually got fixed.

*** This bug has been marked as a duplicate of 117055 ***

Comment 12

[Ben Bucksch (:BenB)]

v