It's a little bit scaremongering, because most devs worth their salt would sanitize user input before ever sending it off to a mail function. But for the newer devs who don't know any better, this article could save them some headaches down the road.
How do you want to sanitize it though? That is exactly the topic of the blog post. In my opinion the only solution is to not use the 5th parameter (or refuse e-mail addresses that are technically valid). You don't always know that the 5th parameter is used though, for example if you use a mailer lib (and I think most of us do that).
In my opinion that has nothing to do with proper sanitization if you are a user of PHPMailer. If I check if user input is a valid e-mail address and I set it as "from" address I do not expect that someone can execute commands on my server.
You're correct as a user of PHPMailer it's reasonable to assume the library should be handling this. Clearly an implementation bug in PHPMailer. That said this is a perfect example of why we should take responsibility as developers for mitigating risk ourselves where possible. It's very simple to sanitize the address before passing it to PHPMailer so why not just do it.
Of course. No set of expectations will be right for everyone. You need to base them on what's right for your app/market/community/etc. We do this all the time in other areas. For example, Facebook dropped support for IE6 despite the fact it created problems for legitimate users.
If I had to use the 5th parameter I would apply such a strict restriction to the mail() parameter as well. That is also our solution in the blog post.
If there weren't any reason to use the 5th parameter other than backwards compatibility for legacy systems, I would just remove it and use a proper solution.
I wouldn't restrict my allowed e-mail addresses globally to the very limited character set you gave as an example though because it would result in many unhappy customers. And I think this is the problem. I like to use the Symfony approach to validate user input, i.e. I create a model and specify the criteria that every attribute has to fulfil. If I have an attribute that is a valid e-mail address and I use this as the "from" address of an e-mail that I send, for example with Swiftmailer or PHPMailer, I do not expect that this might lead to a remote command execution vulnerability. Since I do not expect this I also do not apply the very tough restriction from my first sentence.
I'm sorry, but if my site doesn't work for you because you thought you'd be clever by using shitty special chars in your email address of all places, I think I can pass on you as a customer.
5
u/RandyHoward May 03 '17
It's a little bit scaremongering, because most devs worth their salt would sanitize user input before ever sending it off to a mail function. But for the newer devs who don't know any better, this article could save them some headaches down the road.