Re: CRLF Injection in mail()

>Maybe I'm behind the times, but I just found out about this one today. >Basically if a user can take your form that sends an email, and send a >value like "This is my subject\nBcc: myemail@myisp.com" for the subject, >then they will get Bcc'd on every email your script later sends. One NO! They'll get a Bcc: on the *ONE* email they sent with your FORM. Since they *SENT* the email, that does not seem like much of an issue to me. Or are you *STORING* the Subject:, and then re-using *THEIR* Subject for other emails? Yikes. Why in the world would you do that? If you're letting them decide what the subject is in emails sent out by somebody else, that's just wrong in the first place. >method to use is to download your form (Save As), modify the usual >'text' box into a <textarea> and put in a value like that given above. >Note that it has to be an actual line feed (like in a textarea), not >just a \n typed in (that'll get escaped by magic_quotes, hopefully). If they want to be really kosher, they need \r\n, not just \n in there. Read the RFC's. >Where this comes into play as "bad" is when you're trying to hide email >addresses, and now the user can Bcc: themselves on everything sent out >and find out the email address of everyone. No, no, no. Unless you're foolish enough to let them upload their altered HTML to your web-site, or be sending out emails from other people using *THEIR* subject as data. >Why isn't, or is this, considered a bug? Is there any valid reason for >PHP not to check for this itself and say that Subject (and whatever >other fields are vulnerable) can only contain a subject header and >that's it? > >What do you think? If you are worried about it, your PHP script can simply check the subject before you send the email. <?php $subject = explode("\n", $subject); $subject = trim($subject[0]); mail(...,$subject,...); ?> It's certainly not a PHP "bug" for PHP to let you put whatever you want in your Subject, no matter how badly-designed that might be. It's not PHP's job to stop you from doing "stupid" things :-) -- Like Music? http://l-i-e.com/artists.htm