Re: [Django] #34753: Document how to safely construct email addresses

[Django]

#34753: Document how to safely construct email addresses
--------------------------------------+------------------------------------
Reporter: Sylvain Fankhauser | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: Documentation | Version:
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Comment (by Mike Edmunds):

I would suggest reworking the entire existing "Preventing header
injection" section as part of this change. Both the text and example can
be improved.

A more useful example might be actually treating it as a typical contact
form, with name, email, subject and message fields:
- from_email would be `f'"{name} via contact form" <contact-
fo...@example.com>` (but formatted ''safely'')
- to would be a constant (`["con...@example.com"]` or something like
that)
- reply_to would be `[f"{name} <{email}>"]` (but formatted ''safely'')
- subject & body would come from the form

This corrects another problem in the current example: trying to use an
email from a web form as the from_email. (No email service lets you send
messages ''from'' any random address.)
--
Ticket URL: <https://code.djangoproject.com/ticket/34753#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#34753: Document how to safely construct email addresses

-------------------------------------+-------------------------------------
Reporter: Sylvain Fankhauser | Owner: Raghav-
Type: | Bodani
Cleanup/optimization | Status: assigned

Component: Documentation | Version:
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

-------------------------------------+-------------------------------------
Changes (by Raghav-Bodani):

* owner: nobody => Raghav-Bodani
* status: new => assigned

Comment:

I’m planning to work on updating the email documentation to cover safe
construction of email addresses, incorporating the suggestions above.
--
Ticket URL: <https://code.djangoproject.com/ticket/34753#comment:5>

[Django]

#34753: Document how to safely construct email addresses
-------------------------------------+-------------------------------------
Reporter: Sylvain Fankhauser | Owner: Raghav

Type: | Bodani
Cleanup/optimization | Status: assigned
Component: Documentation | Version:
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Comment (by Raghav Bodani):

Quick update: the first draft of the documentation changes is ready. I
will do a final review and open a PR once it’s ready.
--
Ticket URL: <https://code.djangoproject.com/ticket/34753#comment:6>

[Django]

#34753: Document how to safely construct email addresses
-------------------------------------+-------------------------------------
Reporter: Sylvain Fankhauser | Owner: Raghav
Type: | Bodani
Cleanup/optimization | Status: assigned
Component: Documentation | Version:
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Raghav Bodani):

PR: https://github.com/django/django/pull/20431
--
Ticket URL: <https://code.djangoproject.com/ticket/34753#comment:7>

[Django]

#34753: Document how to safely construct email addresses
-------------------------------------+-------------------------------------
Reporter: Sylvain Fankhauser | Owner: Raghav
Type: | Bodani
Cleanup/optimization | Status: assigned
Component: Documentation | Version:
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted

Has patch: 1 | Needs documentation: 0

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Raghav Bodani):

* has_patch: 0 => 1

--
Ticket URL: <https://code.djangoproject.com/ticket/34753#comment:8>