OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: header_check: regexp or PCRE? false positives?

From: Roger B.A. Klorese (rogerkqueernet.org)
Date: Mon Jan 03 2005 - 15:25:18 CST


Matt wrote:

> Just because it cannot be seen, or hasn't been observerd *YET*, does not
>mean that the possibility isn't there :) If what you mention wasn't
>problematic, we wouldn't have people writing mail sanitisers, would we?
>
>

People are likely to sanitize "expected" cases even if they have not
ever occurred. Taken to an extreme, this can and does interfere with
real mail.