Invalid value separators in notification email headers

[hg]

Description

Hi,

I've been trying out email replies merged in #22056.

They are breaking aerc (the email client) with this message:

worker.go:536: could not get message info: mail: missing '<' in msg-id

https://github.com/emersion/go-message/blob/master/mail/header.go#L174-L181

Naturally, I thought the issue was with the client, but after digging for a while found out that gitea joins email header values (References, List-Unsubscribe, probably others) using commas as separators.

References: <xxx/yyy/issues/42@git.example.com>,
 <reply-xxxxxxxxyyyyyyyyyyyyyyyzzzzzzzzzzzz@git.example.com>

List-Unsubscribe: <https://git.example.com/xxx/yyy/issues/42>,
  <mailto:git+qwertyuiopasdfghjzxcvbn@example.com>

I don't think this is valid email. RFC5322 requires CFWS to separate header values (which is either comments or whitespace), and does not allow commas.

Could you please confirm if this is a bug?

Gitea Version

1.19.0+dev-444-g2c6cc0b8c

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker, gitea/gitea:dev

Database

PostgreSQL

[KN4CK3R]

We use https://github.com/go-gomail/gomail/ which adds the , seperator: https://github.com/go-gomail/gomail/blob/81ebce5c23dfd25c6c67194b37d3dd3f338c98b1/writeto.go#L165

[wxiaoguang]

One more issue of the unmaintained gomail package?

• gomail library unmaintained #18664

[wxiaoguang]

This comment seems to be not related. Hide the content.

I think the problem might not be related to gomail, but somewhat/somehow related to:

• Always set a unique Message-ID header #17206
• https://github.com/go-gitea/gitea/pull/17206/files#diff-ddb83baac441bb9b1238970b8f52b7be0d45aa2c23916b4cac5d9b365a1866cfR336

fmt.Sprintf("%s/%s/%d%s@%s" doesn't look good to be used as a message-id (even if it's quoted by < by its callers)

And then it's changed to fmt.Sprintf("<%s/%s/%d%s@%s>" in #22056.

• https://github.com/go-gitea/gitea/pull/22056/files#diff-ddb83baac441bb9b1238970b8f52b7be0d45aa2c23916b4cac5d9b365a1866cfR393

I haven't read the standard yet, but it looks related to the error message: "worker.go:536: could not get message info: mail: missing '<' in msg-id"

So, maybe it's time to check some standard documents 😀

[KN4CK3R]

The error message is (just a first look) because the parser wants to read a < but gets a ,.