Opened 7 years ago

Last modified 5 years ago

#28726 closed Cleanup/optimization

Brackets illegal in DEFAULT_FROM_EMAIL name part — at Version 1

Reported by: Ciaran Courtney Owned by: nobody
Component: Core (Mail) Version: 3.0
Severity: Normal Keywords: email DEFAULT_FROM_EMAIL
Cc: Adam Johnson Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description (last modified by Jani Sumak)

Using DEFAULT_FROM_EMAIL = '[test] Bob <noreply@example.com>' will fail in django.core.mail.message.sanitize_address() at parseaddr(addr)

Possibly other characters are illegal. The docs don't mention the use of DEFAULT_FROM_EMAIL in this way, perhaps documentation can cover it.

Change History (1)

comment:1 by Jani Sumak, 7 years ago

Description: modified (diff)
Triage Stage: UnreviewedAccepted

If from_email is not provided, EmailMessage or EmailMultiAlternatives will use DEFAULT_FROM_EMAIL. If DEFAULT_FROM_EMAIL is not a tuple sanitize_address will pass DEFAULT_FROM_EMAIL to the function parseaddr from the email module in the standard library. parseaddrwill then try to parse RFC 2822 addresses.

Space and "(),:;<>@[\] characters are allowed with restrictions (https://stackoverflow.com/a/2049510/4819353). If you pass a suqare bracket [ to parseaddr it will return someting like this: [('', ''), ('', 'test'), ('', ''), ('Bob', 'noreply@example.com')]. Since sanitize_addresswill use only the first element from the returned list, you will get an error.

I suggest that the documentation mentions some of this.

DEFAULT_FROM_EMAIL¶
...

The value should be a tuple containing two strings, `(name, address)`,  or a string in the form of `name <email@example.com>`.
Note: See TracTickets for help on using tickets.
Back to Top