Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add DSN mail option #2157

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Add DSN mail option #2157

wants to merge 5 commits into from

Conversation

vjardin
Copy link

@vjardin vjardin commented Oct 5, 2020

It can be used to support the section 4.3 and 4.4 regarding
RET={FULL|HDRS} and ENVID=xyzIDxyz of the RFC:
https://tools.ietf.org/html/rfc3461

It can be used to support the section 4.3 and 4.4 regarding
RET={FULL|HDRS} and ENVID=xyzIDxyz of the RFC:
  https://tools.ietf.org/html/rfc3461
@Synchro
Copy link
Member

Synchro commented Oct 6, 2020

While this could be useful for some, I see a few issues with this implementation.

  1. No consideration for RFC6533. While PHPMailer currently lacks support for SMTPUTF8, it does have support for IDNs, which have a bearing on this.
  2. It's dangerous as there is no validation at all, making it an obvious point for SMTP and header injection attacks should someone be so foolish as to pass user-provided data into a property that ends up in the DSN.
  3. How widespread is the adoption of this SMTP extension? I don't see it in any of gmail, yahoo, hotmail, but it is present in office365.

@vjardin
Copy link
Author

vjardin commented Oct 6, 2020

Regarding 1, it follows the same design than the support of recipient() https://github.com/PHPMailer/PHPMailer/blob/master/src/SMTP.php#L912 ; RFC6533 is a work to be done, but it shall be part of another pull request serie.

Regarding 2, you are right, I'll think about a better API, close to the support of $dsn (https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L375).

Regarding 3, of course it is widely supported for a while. On the sender side, for instance, postfix does support it too: https://manpages.debian.org/testing/postfix/sendmail.1.en.html

@vjardin
Copy link
Author

vjardin commented Oct 7, 2020

@Synchro
Copy link
Member

Synchro commented Oct 7, 2020

Another consideration – the DSN extension to MAIL FROM should only be used if the DSN extension is listed in the server's capabilities, otherwise you're likely to have problems with servers that don't support DSNs. You can check this by calling $this->getServerExt('DSN'), which will return false if the server does not support DSNs.

The previous commit added the support of DSN thru a loose support of DSN
for the MAIL FROM command.

This commit checks that only FULL|HDRS and the optionaly ENVID can be
used which prevent any wrong syntax from the users.
@vjardin
Copy link
Author

vjardin commented Oct 7, 2020

WIP with this previous commit. I'll provide an update using getServerExt()

Only DSN capable servers should get the optional MAIL FROM
commands.

Suggested-by: Marcus Bointon (@Synchro)
@vjardin
Copy link
Author

vjardin commented Oct 7, 2020

@Synchro thanks for your comments. See enclosed the updates of this pull request.

@vjardin
Copy link
Author

vjardin commented Oct 7, 2020

Dam'd ! I forgot php-cs-fixer, hold on please. I'll post an update.

Apply php-cs-fixer --diff --dry-run --verbose fix
@vjardin
Copy link
Author

vjardin commented Oct 7, 2020

done

Add some basic unit tests of the DSN

run: php dsn.php
@vjardin
Copy link
Author

vjardin commented Oct 10, 2020

@Synchro : please do you have some comments about this serie ? I included the features you requested.

thank you,

@vjardin
Copy link
Author

vjardin commented Oct 15, 2020

Please, do you have some comments ?

src/SMTP.php Outdated
@@ -947,7 +947,7 @@ public function mail($from, $ret = '')
$useVerp = ($this->do_verp ? ' XVERP' : '');

$useRet = '';
if (!empty($ret)) {
if ($this->getServerExt('DSN') && !empty($ret)) {
$useRet = self::dsnize($ret);
if (!is_string($useRet))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be better to make this more explicit:

if ($useRet === false)

@Synchro
Copy link
Member

Synchro commented Oct 15, 2020

Sorry, lots of other things going on.

For the tests, could you reformulate that as tests within the test suite (in tests/PHPMailerTests.php)? Rather than having the values to encode and then checking them visually, write code that checks them.

@vjardin
Copy link
Author

vjardin commented Oct 26, 2020

OK, I'll give a try by end of the week.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants