diff --git a/src/logging.cc b/src/logging.cc index 0da69cc62..b5a228e63 100644 --- a/src/logging.cc +++ b/src/logging.cc @@ -2320,98 +2320,12 @@ static inline void trim(std::string &s) { // log_mutex. static bool SendEmailInternal(const char*dest, const char *subject, const char*body, bool use_logging) { -#ifndef GLOG_OS_EMSCRIPTEN - if (dest && *dest) { - // Split the comma-separated list of email addresses, validate each one and - // build a sanitized new comma-separated string without whitespace. - std::istringstream ss(dest); - std::ostringstream sanitized_dests; - std::string s; - while (std::getline(ss, s, ',')) { - trim(s); - if (s.empty()) { - continue; - } - // We validate the provided email addresses using the same regular - // expression that HTML5 uses[1], except that we require the address to - // start with an alpha-numeric character. This is because we don't want to - // allow email addresses that start with a special character, such as a - // pipe or dash, which could be misunderstood as a command-line flag by - // certain versions of `mail` that are vulnerable to command injection.[2] - // [1] https://html.spec.whatwg.org/multipage/input.html#valid-e-mail-address - // [2] e.g. https://nvd.nist.gov/vuln/detail/CVE-2004-2771 - if (!std::regex_match( - s, - std::regex("^[a-zA-Z0-9]" - "[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]*@[a-zA-Z0-9]" - "(?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9]" - "(?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$"))) { - if (use_logging) { - VLOG(1) << "Invalid destination email address:" << s; - } else { - fprintf(stderr, "Invalid destination email address: %s\n", - s.c_str()); - } - return false; - } - if (!sanitized_dests.str().empty()) { - sanitized_dests << ","; - } - sanitized_dests << s; - } - dest = sanitized_dests.str().c_str(); - - if ( use_logging ) { - VLOG(1) << "Trying to send TITLE:" << subject - << " BODY:" << body << " to " << dest; - } else { - fprintf(stderr, "Trying to send TITLE: %s BODY: %s to %s\n", - subject, body, dest); - } - - string logmailer = FLAGS_logmailer; - if (logmailer.empty()) { - logmailer = "/bin/mail"; - } - string cmd = - logmailer + " -s" + - ShellEscape(subject) + " " + ShellEscape(dest); - if (use_logging) { - VLOG(4) << "Mailing command: " << cmd; - } - - FILE* pipe = popen(cmd.c_str(), "w"); - if (pipe != nullptr) { - // Add the body if we have one - if (body) { - fwrite(body, sizeof(char), strlen(body), pipe); - } - bool ok = pclose(pipe) != -1; - if ( !ok ) { - if ( use_logging ) { - LOG(ERROR) << "Problems sending mail to " << dest << ": " - << StrError(errno); - } else { - fprintf(stderr, "Problems sending mail to %s: %s\n", - dest, StrError(errno).c_str()); - } - } - return ok; - } else { - if ( use_logging ) { - LOG(ERROR) << "Unable to send mail to " << dest; - } else { - fprintf(stderr, "Unable to send mail to %s\n", dest); - } - } + const char* error = "Sending emails is disabled (#11930)."; + if ( use_logging ) { + LOG(ERROR) << error; + } else { + fputs(error, stderr); } -#else - (void)dest; - (void)subject; - (void)body; - (void)use_logging; - LOG(WARNING) << "Email support not available; not sending message"; -#endif return false; }