PHPMailer Exploit – Remote Code Execution

Re:PHPMailer Exploit – Remote Code Execution by x0 on Wednesday December 28, 2016 @06:13AM (#13269822)

That's how I do it. Check for an @. Anything past that is sendmail's problem.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by nkozyra on Wednesday December 28, 2016 @07:21AM (#13270038)

Even though it false positives some valid emails, I've always felt requiring a @ and a . is a good check for public facing validation.

[ Parent | on HN ]

Re:PHPMailer Exploit – Remote Code Execution by Piskvorrr on Thursday December 29, 2016 @05:48AM (#13276669)

Technically valid e-mail addresses - but nonsensical ones. I haven't seen an e-mail without a domain cross a network in decades ("cross a network" excepts "user@localhost", and I'm not old enough to have seen any IP-adressed mails ;)).

So yes, I believe that in 2016, a match on ^[^@]+@([^.@]+\.)+[^.@]+\.?$ does not have any actual false negatives, although allowing false positives. That's not entirely helpful in this CVE, though.

[ Parent | on HN ]