Merge branch 'master' into debian

3 files changed, 14 insertions, 4 deletions

diff --git a/README b/README
index 8fcbb05..6c3ae34 100644
--- a/README
+++ b/README
@@ -33,7 +33,6 @@ extensions are:
   * SASL-IR [RFC4959] SASL Initial Client Response, and
   * UNSELECT [RFC3691].
 
-
 _______________________________________________________________________
 
 IMAP traffic is mostly text (beside message bodies perhaps) hence
@@ -81,7 +80,6 @@ the remote server supports the IMAP COMPRESS extension [RFC4978], adding
 compress=DEFLATE to the configuration can also greatly reduce bandwidth
 usage with regular INET sockets (type=imaps or type=imap).
 
-
 _______________________________________________________________________
 
 InterIMAP is Copyright© 2015 Guilhem Moulin ⟨guilhem@fripost.org⟩, and
diff --git a/pullimap b/pullimap
index e971f64..d176464 100755
--- a/pullimap
+++ b/pullimap
@@ -269,13 +269,24 @@ sub purge() {
 my $ATTRS = "ENVELOPE INTERNALDATE";
 $ATTRS .= " BODY.PEEK[]" unless $CONFIG{'no-delivery'};
 
+my $RE_ATOM = qr/[A-Za-z0-9\x21\x23-\x27\x2A\x2B\x2D\x2F\x3D\x3F\x5E-\x60\x7B-\x7E]+/;
 sub pull_callback($$) {
     my ($uids, $mail) = @_;
     return unless exists $mail->{RFC822} or $CONFIG{'no-delivery'}; # not for us
 
     my $uid = $mail->{UID};
     my $from = first { defined $_ and @$_ } @{$mail->{ENVELOPE}}[2,3,4];
-    $from = (defined $from and @$from) ? $from->[0]->[2].'@'.$from->[0]->[3] : '';
+    if (defined $from and @$from) {
+        my ($l, $d) = @{$from->[0]}[2,3];
+        unless ($l =~ /\A$RE_ATOM(?:\.$RE_ATOM)*\z/o) { # quote the local part if not Dot-string (RFC 5321)
+            $l =~ s/([\x22\x5C])/\\$1/g; # escape double-quote and backslash
+            $l = '"' .$l. '"';
+        }
+        $from = $l .'@'. $d;
+        $IMAP->fail("Invalid character in MAIL FROM: <$from>") unless $l =~ /\A[\x20-\x7E]*\z/;
+    } else {
+        $from = '';
+    }
     $IMAP->log("UID $uid from <$from> ($mail->{INTERNALDATE})") unless $CONFIG{quiet};
 
     sendmail($from, $mail->{RFC822}) unless $CONFIG{'no-delivery'};
diff --git a/pullimap.md b/pullimap.md
index 5ff3af1..06e5988 100644
--- a/pullimap.md
+++ b/pullimap.md
@@ -110,7 +110,8 @@ Valid options are:
 
 *deliver-rcpt*
 
-:   Message recipient.
+:   Message recipient.  Note that the local part needs to quoted if it
+    contains special characters; see [RFC 5321] for details.
     (Default: the username associated with the effective uid of the
     `pullimap` process.)