Email Injection attacks

rubyonrails-talk
1

I wonder if it is enough to scan the message body for and replace them?

-- Long http://MeandmyCity.com/ - Free, searchable business directory for local communities http://edgesoft.ca/blog/read/2 - No-Cookie Session Support plugin for Rails

2

not just the message body. you'd have to scan the headers (to, from, subject) for anything that should'nt be there or not in the correct format.

see

http://www.securephpwiki.com/index.php/Email_Injection

for a list of example scenarios.

3

I agree. Each form field should be scanned.

-- Long

Chris Hall wrote: