Re: mailbot -A 'From' and "Messages with multiple addresses in From:"

From: Sam Varshavchik <[email protected]>
> Sent: Wednesday, December 27, 2017 11:55 AM
> To: [email protected]
> Subject: Re: [maildropl]  mailbot -A 'From' and "Messages with multiple addresses in From:"
> 
> Tommaso Massimi writes:
> 

[...]

> > this is how I'm calling mailbot:
> >
> >
> >  cc "| mailbot -t $RESPOND   -T forward \
> >                    -A 'To: $5'  -A 'From: $USERNAME'  -s 'Auto Response: from
> > $USERNAME'  \
> 
> And what exactly is USERNAME at this point? It is not one of the variables
> that's set by maildrop. Have you actually looked at the formatted message,
> and verified that it has two distinct From: headers, instead of one with
> multiple addresses? It's likely that your USERNAME contains something that
> looks like multiple E-mail addresses.

USERNAME=`cat username.txt`

username.txt it is a file I use in order to have the same "From:" also when an email comes from an alias

and you are right, I had a mistake in my username.txt:

<user>user@domain

is creating 2 fields "From:". 

using the right syntax
user<user@domain> 
all is fine

> Furthermore, hopefully, that $5 is sanitized for shell quotes and meta
> characters, at this point. If it's not, and it gets set to something from
> the original message, then hopefully it's not possible for someone to send
> you a specially crafted message that results in $5 getting manipulated to
> contain
> 
> '; rm -rf $HOME;

> which would result in lots of fun, and hillarity.

good point,  $5 is the ${sender} field passed by postfix pipe command.
'man pipe' doesn't cover this point, but I assume that pipe is sanitizing it as the sender field cannot contains all the characters

Thanks a lot

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot