Bug#1141543: debbugs: fails to separate sendmail flags from recipient addresses

On Sun, 05 Jul 2026, Ben Wong wrote:n
> Source: debbugs
> Version: 2.6.5
> Severity: normal
> Tags: patch
> 
> Dear Maintainer,
> 
> There is some curious code in Mail.pm:
> 
>     for my $recipient ($param{parse_for_recipients}?q(-t):(),@recipients)
>         eval {
>             _send_message($param{message},@sendmail_arguments,$recipient);
> 
> As you can see, it sometimes sets $recipient="-t" to modify how
> sendmail works. While clever, it suggests a possible security problem.
> In particular, a recipient address may be interpreted as an option
> flag. For example,
> 
>     sendmail -oem -oi -oQ/tmp/[email protected] [email protected]

Yeah, this is something we should fix, since you could have a mail
address starting with -. Not sure exactly if sendmail parses that
correctly.

The patch has some extraneous changes and should be simplified a bit (we
should put -t into @sendmail_arguments instead, or have it use -t when
there isn't any recipients instead of calling the same code twice.)

I'll look into this later on today.