From f82ff472e5ccfa07f99a0eff5e98c5bc5ebf3e9b Mon Sep 17 00:00:00 2001
From: Mark Sapiro <mark@msapiro.net>
Date: Thu, 16 Jan 2020 16:03:34 -0800
Subject: Fixed SimpleMatch to only return valid addresses.

---
 Mailman/Bouncers/SimpleMatch.py   |  5 ++++-
 Mailman/Bouncers/SimpleWarning.py | 30 ++++++++++++++++++++++++------
 2 files changed, 28 insertions(+), 7 deletions(-)

(limited to 'Mailman')

diff --git a/Mailman/Bouncers/SimpleMatch.py b/Mailman/Bouncers/SimpleMatch.py
index ca648f65..fd833a40 100644
--- a/Mailman/Bouncers/SimpleMatch.py
+++ b/Mailman/Bouncers/SimpleMatch.py
@@ -25,6 +25,9 @@ import email.Iterators
 def _c(pattern):
     return re.compile(pattern, re.IGNORECASE)
 
+# Pattern to match any valid email address and not much more.
+VALID = _c(r'[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+')
+
 # This is a list of tuples of the form
 #
 #     (start cre, end cre, address cre)
@@ -227,4 +230,4 @@ def process(msg, patterns=None):
                     break
         if addrs:
             break
-    return addrs.keys()
+    return [x for x in addrs.keys() if VALID.match(x)]
diff --git a/Mailman/Bouncers/SimpleWarning.py b/Mailman/Bouncers/SimpleWarning.py
index 43ad5396..e51e5931 100644
--- a/Mailman/Bouncers/SimpleWarning.py
+++ b/Mailman/Bouncers/SimpleWarning.py
@@ -17,9 +17,10 @@
 
 """Recognizes simple heuristically delimited warnings."""
 
+import email
+
 from Mailman.Bouncers.BouncerAPI import Stop
 from Mailman.Bouncers.SimpleMatch import _c
-from Mailman.Bouncers.SimpleMatch import process as _process
 
 
 
@@ -67,8 +68,25 @@ patterns = [
 
 
 def process(msg):
-    if _process(msg, patterns):
-        # It's a recognized warning so stop now
-        return Stop
-    else:
-        return []
+    # We used to just import process from SimpleMatch, but with the change in
+    # SimpleMatch to return only vaild addresses, that doesn't work any more.
+    # So, we copy most of the process from SimpleMatch here.
+    addrs = {}
+    for scre, ecre, acre in patterns:
+        state = 0
+        for line in email.Iterators.body_line_iterator(msg, decode=True):
+            if state == 0:
+                if scre.search(line):
+                    state = 1
+            if state == 1:
+                mo = acre.search(line)
+                if mo:
+                    addr = mo.group('addr')
+                    if addr:
+                        addrs[addr.strip('<>')] = 1
+                elif ecre.search(line):
+                    break
+        if addrs:
+            # It's a recognized warning so stop now
+            return Stop
+    return []
-- 
cgit v1.2.3