[Mimedefang] Bare returns in message body

[Jan Pieter Cornet]

On Wed, Nov 09, 2005 at 08:37:54AM -0500, David F. Skoll wrote:
> Jan Pieter Cornet wrote:
> 
> > Nothing that I can think of easily. Perl has no problem with character
> > data, in general.
> 
> Nevertheless, I seem to recall that many perl *modules* do have
> problems with embedded CR's.  I believe (old versions of?) SpamAssassin
> had difficulties.  And I suspect that MIME::Tools won't handle it well.

MIME::Tools (at least 5.418) has no problems with embedded CRs in the
body parts itself.

> Also, when I write the message body to INPUTMSG, I transform CRLF to
> LF so the line endings follow UNIX semantics.  Otherwise, lots of
> Perl code *does* have problems.

Absolutely. That's not what I meant to suggest. You should do the
normal CRLF -> LF substition to transform "on the wire" format to
regular "unix line ending" format.

However, you're ALSO removing lone CRs in the process, CR characters
that a MUA will see, and might react upon (it might even trigger
a bug in the MUA... a bug which is scanned for in some virus scanner,
but that fails to detect it because the CR characters aren't there.
This is speculation, however).

Here's (imo) the fundamental problem here: the mimedefang filter is not
given the same message that end user sees... lone CR characters will be
removed from it (line ending CRLF will also be converted by sendmail
or the local delivery agent to just LF, that's not the point).

On Wed, Nov 09, 2005 at 01:56:46PM -0500, David F. Skoll wrote:
> I know of no good way to handle this.  I'm inclined to simply reject
> messages with embedded CR's because MTAs sending such messages over
> the wire are violating a MUST NOT requirement.

In an ideal world, I'd love to enforce strict RFC compliance to all
incoming mail. It would remove a lot of spam. Unfortunately, there's
also a company out there, quite popular among users I might add,
that not only regularly violates RFCs, but seems to be making a sport
out of setting them on fire and sending a stampede of bad programmers
over it.

I mean... just look at how successful rfc-ignorant.org is...

If you care about the mail your users actually want to receive, some
RFCs have to be bent. Unfortunately.

-- 
#!perl -wpl # mmfppfmpmmpp mmpffm <pmmppfmfpppppfmmmf at fpffmm4mmmpmfpmf.ppppmf>
$p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig;                                # Jan-Pieter Cornet