# Email Injection attacks

**URL:** <https://www.ruby-forum.com/t/email-injection-attacks/102988>\
**Category:** Rails\
**Created:** [January 22, 2007, 6:06pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988 "2007-01-22T18:06:28Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 22, 2007, 6:06pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/1 "2007-01-22T18:06:28Z")

</div>

I’ve heard that it’s possible to halt email injection attacks by using  
validate\_request, but does anyone have an example of how to actually do  
this? Thanks

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 22, 2007, 7:29pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/2 "2007-01-22T19:29:17Z")

</div>

Joe P. wrote:

> I’ve heard that it’s possible to halt email injection attacks by using  
> validate\_request, but does anyone have an example of how to actually do  
> this? Thanks

I’ve done this in PHP, but is there a good way to do this in RoR?

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 23, 2007, 3:40pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/3 "2007-01-23T15:40:38Z")

</div>

Anyone?

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 3:17pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/4 "2007-01-24T15:17:09Z")

</div>

Surely someone must know something about this.

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 3:51pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/5 "2007-01-24T15:51:59Z")

</div>

please don’t bump your message just because you didn’t get a reply.  
if someone was interested or had an answer, i’m sure they would have  
answered by now.

that being said, i assume by validate\_request you mean the plugin.  
after looking at the readme/usage it appears to only support:

1. validating type of request
2. validating a parameter as either an integer or string
3. validating a string parameter against a specific string
4. validating a parameter against a model

in other words, i don’t see how you could stop email injection based  
on that functionality.

now, that’s not to say you couldn’t do those checks in your code  
yourself, where necessary. no plugin is necessary.

check if request is a post/get  
check form fields against email injection (ie, match header fields  
against one or more regular expressions)

point is, you’re going to have to do the same thing regardless of the  
language.

now, most of the email injection info i’ve seen has to do with how the  
php mail() function constructs the mail message itself. ActionMailer  
may not be prone to this type of attack if it functions differently.  
Not it say it is or is not, because I don’t know.

Chris

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 5:36pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/6 "2007-01-24T17:36:45Z")

</div>

I wonder if it is enough to scan the message body for  
To:, Bc:, Cc: and there was something else (Content-something)  
and replace them?

– Long  
[http://MeandmyCity.com/](http://MeandmyCity.com/) - Free, searchable business directory for local  
communities  
[http://edgesoft.ca/blog/read/2](http://edgesoft.ca/blog/read/2) - No-Cookie Session Support plugin for  
Rails

----- Original Message -----  
From: “Joe P.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
Sent: Wednesday, January 24, 2007 9:17 AM  
Subject: [Rails] Re: Email Injection attacks

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 5:59pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/7 "2007-01-24T17:59:50Z")

</div>

not just the message body. you’d have to scan the headers (to, from,  
subject) for anything that should’nt be there or not in the correct  
format.

see

[http://www.securephpwiki.com/index.php/Email\_Injection](http://www.securephpwiki.com/index.php/Email_Injection)

for a list of example scenarios.

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 7:22pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/8 "2007-01-24T19:22:08Z")

</div>

I agree. Each form field should be scanned.

– Long

---

<div class="post-metadata">

**Author:** ![joep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/87869e/32.png) [@joep](https://www.ruby-forum.com/u/joep)\
**Post date:** [January 24, 2007, 7:42pm UTC](https://www.ruby-forum.com/t/email-injection-attacks/102988/9 "2007-01-24T19:42:54Z")

</div>

Wow, thanks for all the information everyone. Weird how this gets no  
replies for two days, then gets a bunch all in one day. Thanks again.