When setting return_path in the email header.

the function

protected static function _isShellSafe($string)

Wrongly flags emails containing åøæ@åøæ.dk as not shellsafe althou being a possibly correct.
We also have reports of other mails being incorrectly marked as non shell safe.

The workaround is not to use return_path.

Comments

TobiasFPetersen created an issue. See original summary.

salvis’s picture

salvis
he/his
commented
Category: Bug report » Support request
Status: Active » Fixed

I don't believe these characters are allowed in email addresses. Please check the applicable RFC.

_isShellSafe() was introduced into Core and related Contribs in https://www.drupal.org/sa-core-2018-006 "Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution - Drupal 7 and Drupal 8". If you want to pursue this any further, you should raise the discussion in the context of Core.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.