[ZCM] [ZC] 2266/ 8 Unrestrict "MIME injection problems with dtml-sendmail"

Issue #2266 Update (Unrestrict) "MIME injection problems with dtml-sendmail"
 Status Pending, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2266

==============================================================
= Unrestrict_pending - Entry #8 by ajung on Jan 16, 2007 1:14 am

 Triggered by security_related toggle.
________________________________________
= Edit - Entry #7 by ajung on Jan 16, 2007 1:13 am

 Changes: security_related unset
________________________________________
= Comment - Entry #6 by ajung on Jan 15, 2007 1:22 pm

This issue is not security related, it must not be confidential.
________________________________________
= Comment - Entry #5 by philikon on Jan 15, 2007 1:15 pm

If we still consider <dtml-sendmail> to be the recommended way of sending emails from Zope we should introduce <dtml-smtpvar> in analogy to <dtml-sqlvar>. If someone wants to do this, fine, but I actually think that sending emails should be done from Python (like Itamar suggests, the Python email package provides much better abstraction for MIME messages). So like Andreas suggests, we should add big warnings signs to the <dtml-sendmail> docs plus a note to script this from Python instead.
________________________________________
= Comment - Entry #4 by ajung on Jan 15, 2007 1:09 pm

I consider this issues basically a question of documentation and programming-style. <dtml-var> offers several options to quote the content (so you can solve this on the application level). I don't want to see any magic like auto-quoting for <dtml-var> when called inside <dtml-sendmail>. I agree that it should be documented somewhere. 
________________________________________
= Edit - Entry #3 by ajung on Jan 15, 2007 1:03 pm

 Changes: submitter email, importance (critical => medium)
________________________________________
= Comment - Entry #2 by itamarst on Jan 15, 2007 12:33 pm

Notice that I'm not making the common mistake of setting the To header with a form argument, the recipient of the email is hardcoded.
________________________________________
= Request - Entry #1 by itamarst on Jan 15, 2007 12:28 pm

A spammer recently used one of our mail forms to send spam. Some investigation revealed that while it was, in theory, our fault in coding it, in practice it's a fundamental issue with dtml-sendmail.

Consider:
<dtml-sendmail>
To: [email protected]
From: <dtml-var sender>
Subject: Automated email from example.com

Reply to sender with info about our products.
</dtml-sendmail>

Looks fine, right? Except, we can use this form to send email to *anyone*, by using linebreaks, which lets the spammer to add new lines:

www.example.com/[email protected]%0ATo:%[email protected]%0A%0ABody%20of%20spam

will send a spam with body "Body of spam" to [email protected]. This is MIME injection, similar to SQL injection attacks.

None of the dtml-sendmail examples on zope.org note the need for quoting in dtml-sendmail, so I suspect this is common issue. The problem is due to the fact you use templating for MIME, which really isn't a very good idea.

Possible solutions:
1. Update various dtml-sendmail docs to note need for quoting.
2. Change behavior of dtml-sendmail in some way to prevent this.
3. Tell people not to use dtml-sendmail at all.

I vote for #3, but #1 is certainly the easiest thing to do.
==============================================================