From Address Not Being Parsed Correctly

[neelchauhan]

I use Roundcube on a self-hosted personal email server and subscribe to the FreeBSD.org mailing lists, since I'm a FreeBSD developer/committer.

Often times, spam comes through FreeBSD mailing lists and in turn gets forwarded to my server.

One of the spam emails caught my eye, it escaped the "From" address header HTML parsing: "freebsd.org"<noreply@freebsd.org. It wasn't even a highlighted link, which is abnormal.

While this may or may not be innocent, it could be exploited, say if an organization requiring high security uses Roundcube and spam comes in exploiting this address header bug.

I don't know how other email systems do it.

Raw Email (incl headers): Raw Email in (formatted as TXT but actually an EMF)

[neelchauhan]

Also sorry if I dumped the titles of my latest emails. I don't know if I can delete it.

[alecpl]

I don't see how it could be exploited. Thunderbird displays it as "freebsd.org" <noreply@freebsd.org>, so I guess we could do the same for this specific case. But anyway, I think it's all right to display the input as-is if it cannot be parsed/is invalid.

[alecpl]

Fixed.