Parse rfc6532 addresses - #3130
Open
chibenwa wants to merge 27 commits into
Open
Conversation
chibenwa
force-pushed
the
parse-rfc6532-addresses
branch
3 times, most recently
from
August 31, 2026 08:39
e673a0c to
2a4b7ca
Compare
This changes the handling of some noncompliant IMAP clients, which James would not tolerate before.
Application-layer code often assumes that addresses can be compared using String.equalsIgnoreCase(), and some also uses regular expressions or substring matching on addresses. This commit provides addresses to upper-layer code in their UTF8 form, so that kind of code continues to work. This might also have security implications: If upper-layer code can be confused about whether two addresses are the same, that sounds as if an attacker could exploit the confusion. This change should block the possibility.
RFC 6532 says we SHOULD do this and JAMES is generally very careful, so I did this as well.
…etc. This should not make a difference, but a sufficiently inventive attacker might combine it with something to confuse some code...
Once the server advertises UTF8=ACCEPT, angus-mail enables it and then takes its supportsUtf8() branch in IMAPProtocol.search(), which passes a null charset down to Argument.writeString(String) and encodes the search strings with ASCIIUtility.getBytes() -- one truncated byte per char. "天天向上" reaches the server as 29 29 11 0A, so the criterion is destroyed client-side before it hits the wire and no server-side decoding can recover it. Same in angus-mail 2.0.5, and there is no property to keep the client from enabling the capability. Send the RFC 6855 wire form ourselves instead: UTF-8 octets in literals, plus a quoted-string variant. These fail against consumeLiteral()'s former US-ASCII decoding, so they cover the gap they were written for.
chibenwa
force-pushed
the
parse-rfc6532-addresses
branch
from
September 3, 2026 08:56
2a4b7ca to
1e8e1e4
Compare
Contributor
Author
|
( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.