Perhaps amusingly, now I look at the code, I see in do_command.c that if safe_p() determines mailfrom contains spaces or parentheses, it will error out. However the very next line of code then sets it to contain both spaces and parentheses! (Yes, I know it is safe.)
My suggestion is to call the sanity checks that already happen at runtime also at save time. If any fail, report them and deny save. My C is extremely rusty but if I understand the code, it seems checking happens in crontab.c in replace_cmd(). So one possibility might be: after load_env(), in the "case TRUE" clause, if envstr is MAILTO=x or MAILFROM=x, then call a safe_p() equivalent on x that invokes check_error() on failure instead of calling log_it(). To avoid code duplication, perhaps it would be better to generalise safe_p() with an extra argument to select how it reports errors (or do dependency injection of the logging function). I haven't looked to see what (if any) other sanity checks happen at runtime that could also usefully be tested at save time. -jonathan georges.khaznadar wrote: > To: deb...@jhnc.org, 1061...@bugs.debian.org > From: Khaznadar Georges <georges.khazna...@orange.fr> > Date: Tue, 27 Feb 2024 09:57:39 +0100 (CET) > Subject: Re: cron: "crontab -e" does not report "unsafe" mail and so job > output can be lost > X-Mailer: Open-Xchange Mailer v7.6.3-Rev71 > > Hello Jonathan, > > I apologize, I had not paid attention to the extra space included in the > > list of MAILTO addresses. > > I suppose that we can sanitize the value of MAILTO, by checking it > > with a regular expression derived from RFC 5322 Official Standard > > (see [1]https://emailregex.com/), or do you suggest some lighter approach? > > Best regards, Georges. > > Jonathan H N Chin a écrit : > > Sorry, my mail server does not seem to have received any email > > from debian when you sent your email on 2024-01-21. Was I > > supposed to have been automatically Bcc'd? > > > > I disagree that the bug is not grave – I believe it meets the > > criterion of data being lost (and was in fact lost by the user). > > However, that does not really bother me. > > > > Note that I used quotation marks around the word unsafe because > > that is the wording used in the syslog message; the addresses are > > not unsafe. The problem is the space character. > > References > > Visible links > 1. https://emailregex.com/
