[Mailman-Developers] Mal Formed MIME post leakedthrough to list

[Mark Sapiro]

Brad Knowles wrote:
>
>	The e-mail related library routines are known to have been 
>updated for Python 2.4, and there's been discussion of whether or not 
>to require Python 2.4 for the next major release of Mailman (not sure 
>if that's going to be 2.2 or 3.0).
>
>	I would be very interested to know how that would have dealt with 
>the problem you've had.  Unfortunately, I don't have the skills or 
>knowledge to help you answer that question.

I've done a bit more research and I intend to continue looking into
this, but I posted in the hope that Barry or someone else on the list
might already have the answer. ans save me some trouble.

Additional things I've found are:

I confirmed that the post e-mail was clearly wrong. RFC2046 states "The
boundary delimiter MUST NOT appear inside any of the encapsulated
parts, on a line by itself or as the prefix of any line." That
notwithstanding, I think the parser and Mailman should protect against
this kind of error.

I looked a bit at the documentation of the email library and based on
that, I think what may have happened is when the parser saw the first
"end of subpart boundary" which looked the same as the outer "end of
part boundary", it took it as the end of the outer part and treated
the rest as an epilogue. Hold.py does the following to compute message
size:

    if mlist.max_message_size > 0:
        bodylen = 0
        for line in email.Iterators.body_line_iterator(msg):
            bodylen += len(line)

but the body_line_iterator() method may skip the epilogue.

Also, I think MimeDel.py will leave the epilogue in the message.

Interestingly, both Thunderbird 1.5b1 and MS Outlook Express 6 seem to
parse the message as intended, but Mutt 1.4.1i sees it more like
Mailman does.

If there's no answer on the list, I intend to keep at it, but not for
the next week as I will be away.

--
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan