PunycodeHelper::emailToPunycode does not support multiple email addresses

[ryandemmer]

Steps to reproduce the issue

In the Global Configuration, set to the Default Editor to "Editor - None"

Go to Content -> Articles -> Create New Article.

Enter in an article title.

In the Content textarea, paste in:

<a href="mailto:john@joomla.org,jack@joomla.org,jane@joomla.org,jill@joomla.org">Email List</a>

Click Save.

Expected result

The content is saved as

<a href="mailto:john@joomla.org,jack@joomla.org,jane@joomla.org,jill@joomla.org">Email List</a>

Actual result

The content is saved as

<a href="mailto:john@joomla.org,jack">Email List</a>

The list is clearly truncated after the first @ symbol. This happens regardless of whether a comma or semi-colon separator is used for the addresses.

System information (as much as possible)

Joomla 3.8.3

Additional comments

This can be traced to
Joomla\CMS\String\PunycodeHelper::emailToPunycode
via
Joomla\CMS\Component\ComponentHelper::filterText
and
Joomla\CMS\Filter\InputFilter::emailToPunycode

[mbabker]

I wouldn't expect Joomla\CMS\String\PunycodeHelper::emailToPunycode to process multiple addresses since the API was clearly designed there for a one-to-one process. Joomla\CMS\Filter\InputFilter::emailToPunycode would be the place that needs to have this logic since it is very clearly filtering the content it is given based on finding a mailto.

With that said though, personally I'd be careful about supporting this. I'm finding conflicting guidance on whether mailto URI schemes should actually support multiple addresses in this manner.

[brianteeman]

It is definitely wrong to have multiple to addresses in the link. If you need to then you should be using cc or bcc (no idea if thats supported or not)

[Quy]

It would be better to use a forwarding/group email address than exposing these email addresses.

[ryandemmer]

I wouldn't expect Joomla\CMS\String\PunycodeHelper::emailToPunycode to process multiple addresses since the API was clearly designed there for a one-to-one process. Joomla\CMS\Filter\InputFilter::emailToPunycode would be the place that needs to have this logic since it is very clearly filtering the content it is given based on finding a mailto.

@mbabker - I intended to update this today after a re-think last night. This issue was the last thing I did before logging off yesterday.

So the target for this issue should be Joomla\CMS\Filter\InputFilter::emailToPunycode

I'm finding conflicting guidance on whether mailto URI schemes should actually support multiple addresses in this manner.

There is nothing in rfc2368 that explicitly forbids the use of multiple email addresses in the link, and the Wikipedia entry for mailto includes an example - https://en.wikipedia.org/wiki/Mailto - citing rfc6068 which also includes an example with multiple email addresses.

Form the point of view of the API, one could insist on restricting the syntax to a single email address, with others added using cc, but this is a user issue, not a developer one, and as this works in desktop email clients, users expect it to work in other situations too.

[ryandemmer]

rfc2822

The destination fields specify the recipients of the message. Each destination field may have one or more addresses, and each of the addresses indicate the intended recipients of the message. The only difference between the three fields is how each is used.

The "To:" field contains the address(es) of the primary recipient(s) of the message.

[ryandemmer]

Updated issue title to reference Joomla\CMS\Filter\InputFilter::emailToPunycode

[brianteeman]

My comment above was wrong

[brianteeman]

Thank you for raising this issue.

Joomla 3 is now in security only mode with no further bug fixes or new features.

This is still an issue in Joomla 4 so I am asking gor the label to be updated to Joomla 4 and maybe someone will be interested in fixing it.

[alikon]

PunycodeHelper::emailToPunycode was not deigned for that
so that's imho not an issue
but as for https://www.rfc-editor.org/rfc/rfc2822#section-3.6.3
a nice to have
i'll move it to discussion

[brianteeman]

This is an issue. Just because punycode does not support it doesn't make it any less important to fix.

[alikon]

i strongly disagree but majority win

[MacJoom]

imho this is an issue. If the user entered something correctly - we should treat it correctly.

[crystalenka]

This has been started again as an issue (as it cannot be directly converted back to issue from discussion). Please refer to the issue #39247 for further info.

[richard67]

Am working on it, see new issue #39247 for further discussion. I have a solution ready for for punicode encoding which works with email lists and also cc and bcc. But that does not help much because when you show an article with such mailto links in frontend you will see that the links are still broken because the email cloaking plugin needs to be fixed (or extended), too, and that's the bigger task. Not sure yet if I can do that, but will try.