Re: A security vulnerability in S8Forum

From: David Wilson (David.Wilsonat_private)
Date: Wed Jan 08 2003 - 10:18:16 PST

  • Next message: Ben Naylor: "RE: Opentype font file causes Windows to restart."

    On Tue, 2003-01-07 at 03:20, Steve Watt wrote:
    > In article <20030105032650.16087.h011.c009.wmat_private> you write:
    > [ snip ]
    > >SOLUTION :
    > >==========
    > [ snip ]
    > > if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$",
    > >$email) &&  $email  != 
    > >"") { 
    > 
    > Please note that there are many more characters valid in the LHS of an
    > email address, for example +, that are often desirable.  Disallowing
    > such addresses is a major nuisance.  
    
    Indeed.
    
    In fact, ANY ASCII character can appear in the local-part of the
    address, because the local part can be a quoted-string and a
    quoted-string can contain any virtually any ASCII.
    
    Then, the domain can be a domain-literal, and this can contain CFWS,
    which can contain comments. Comments cannot be recognised by a regular
    expression as comments nest.
    
    RFC 2822 address validation requires knowlege of that standard.
    
    David Wilson
    Isode Limited
    



    This archive was generated by hypermail 2b30 : Wed Jan 15 2003 - 12:33:53 PST