You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the last year or two I have started to receive a few legitimate emails encoded as UTF-7 (maybe 1 or 2 per 100,000 emails). I noticed that despite attempting to support UTF-7 email bodies, the Mail gem does not decode these emails properly.
Note that standard UTF-7 uses a + character to initiate a special sequence (see Wikipedia). The version using &, which the Mail gem supports, appears to be the "modified UTF-7" described in RFC 9051 and is only intended for email headers/addresses. It is certainly not a valid encoding for email bodies.
Note that
Ruby does not support conversion to/from UTF-7:
irb(main):021> "Hi!".encode(Encoding::UTF_7)(irb):21:in`encode': code converter not found (UTF-8 to UTF-7) (Encoding::ConverterNotFoundError) from (irb):21:in `<main>'irb(main):022> "Hi+ACE-".force_encoding(Encoding::UTF_7).encode(Encoding::UTF_8)(irb):22:in `encode': codeconverter not found(UTF-7toUTF-8)(Encoding::ConverterNotFoundError)from(irb):22:in `<main>'
The Net::IMAP package only supports the "modified UTF-7" version in its decode_utf7 method.
Given that we do not support the correct version of UTF-7 now, that Ruby itself does not support it, and there are many standards recommending against it, I think we should completely remove support for modified UTF-7 in email bodies.
The text was updated successfully, but these errors were encountered:
In the last year or two I have started to receive a few legitimate emails encoded as UTF-7 (maybe 1 or 2 per 100,000 emails). I noticed that despite attempting to support UTF-7 email bodies, the Mail gem does not decode these emails properly.
Note that standard UTF-7 uses a
+
character to initiate a special sequence (see Wikipedia). The version using&
, which the Mail gem supports, appears to be the "modified UTF-7" described in RFC 9051 and is only intended for email headers/addresses. It is certainly not a valid encoding for email bodies.Note that
Given that we do not support the correct version of UTF-7 now, that Ruby itself does not support it, and there are many standards recommending against it, I think we should completely remove support for modified UTF-7 in email bodies.
The text was updated successfully, but these errors were encountered: