Re: [PATCH v2] send-email: provide whitelist of SMTP AUTH mechanisms

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sun, Aug 9, 2015 at 1:19 PM, Eric Sunshine <sunshine@xxxxxxxxxxxxxx> wrote:
> On Sun, Aug 2, 2015 at 2:57 PM, Eric Sunshine <sunshine@xxxxxxxxxxxxxx> wrote:
>> On Sun, Aug 2, 2015 at 12:42 PM, Jan Viktorin <viktorin@xxxxxxxxxxxxxx> wrote:
>>> @@ -1136,6 +1141,10 @@ sub smtp_auth_maybe {
>>>                 Authen::SASL->import(qw(Perl));
>>>         };
>>>
>>> +       if($smtp_auth !~ /^(\b[A-Z0-9-_]{1,20}\s*)*$/) {
>>> +               die "invalid smtp auth: '${smtp_auth}'";
>>> +       }
>>
>> Style: space after 'if'
>
> By the way, I notice that Authen::SASL::Perl implementation itself
> normalizes the incoming mechanism to uppercase, if necessary:
>
>     $mechanism =~ s/^\s*\b(.*)\b\s*$/$1/g;
>     $mechanism =~ s/-/_/g;
>     $mechanism =  uc $mechanism;
>
> Since it doesn't require uppercase, it's not clear how much benefit
> there is to adding a strict regex check to git-send-email.

Hmm, perhaps I was looking at the wrong chunk of code. You had already
referenced the real code here[1], and it doesn't appear to do any case
transformation (it only replaces "-" with "_").

[1]: http://article.gmane.org/gmane.comp.version-control.git/275161
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]