Bug#1141543: debbugs: fails to separate sendmail flags from recipient addresses

On Sun, Jul 05, 2026 at 06:08:12PM -0700, Ben Wong wrote:
> Source: debbugs
> Version: 2.6.5
> Severity: normal
> Tags: patch
> 
> Dear Maintainer,
> 
> There is some curious code in Mail.pm:
> 
>     for my $recipient ($param{parse_for_recipients}?q(-t):(),@recipients)
>         eval {
>             _send_message($param{message},@sendmail_arguments,$recipient);
> 
> As you can see, it sometimes sets $recipient="-t" to modify how
> sendmail works. While clever, it suggests a possible security problem.
> In particular, a recipient address may be interpreted as an option
> flag. For example,
> 
>     sendmail -oem -oi -oQ/tmp/[email protected] [email protected]

This is assuming that debbugs does not validate recipient addresses before that
point, yes ?

Cheers,