Unix command line: character limit?

software development

#1

Is there a limit to the number of characters that can be input on the Unix command line (bash shell)?

I am invoking “sendmail” with the recipient list in the command line, rather than in the e-mail headers. Do I have to watch out for a limit in the number of characters in the addresses I put there?

–David B.
“greendavid”

P.S. This is an alternative to putting the addresses in the Bcc: field, as discussed in a previous thread.


#2

I doubt you’ll encounter the limit, but it’s probably simpler to call sendmail as -t, and put the addresses in the headers directly. Make sure to indent (using tabs) if you continue a line; ie:

Bcc: luser@example.com, luser2@example.com, luser3@example.com,
[tab here]luser4@example.com, […]

I’m not even sure you can specify bcc recipients on the command line…


#3

I know that if you are using sendmail with the recipient on the command line, you have to check for minus signs (flags) and semicolons (additional commands) or you’re asking for trouble.

If you put user data on the To: line, and use the -t flag, what checks should be made to a user-supplied email address to avoid nasty problems?


#4

It was originally my intent to put all recipients in the Bcc: header and use the -t option. But then I read in RFC 2822, “Internet Message Format”, (http://www.faqs.org/rfcs/rfc2822.html) the following:

— begin quote —

Section 3.6.3 Destination address fields

[snip] There are three ways in which the “Bcc:” field is used. [snip] In the second case, recipients specified in the “To:” and “Cc:” lines each are sent a copy of the message with the “Bcc:” line removed as above, but the recipients on the “Bcc:” line get a separate copy of the message containing a “Bcc:” line. [snip] Which method to use with “Bcc:” fields is implementation dependent [snip].

[snip]

Section 5. Security Considerations

[snip] When the second method from section 3.6.3 is used, the blind recipient’s address appears in the “Bcc:” field of a separate copy of the message. If the “Bcc:” field sent contains all of the blind addresses, all of the “Bcc:” recipients will be seen by each “Bcc:” recipient.

— end quote —

Not at all the desired effect for a mailing list application!

–David B.
“greendavid”


#5

I think you’re misunderstanding.

Recipients won’t see the other recipients using sendmail -t.

jazz% /usr/libexec/sendmail/sendmail -t -f asdfasdf@veggiechinese.net
From: asdfasdf@veggiechinese.net
To: asdfasdf@veggiechinese.net
Bcc: will@code404.com, william@dreamhost.com
Subject: test

test
^D

From asdfasdf@veggiechinese.net Wed Sep 11 06:02:42 2002
Return-Path: asdfasdf@veggiechinese.net
Delivered-To: william@roland.code404.com
Received: from jazz.hq.newdream.net (jazz.hq.newdream.net [66.33.200.141])
by roland.code404.com (Postfix) with ESMTP id 86015436
for will@code404.com; Wed, 11 Sep 2002 06:02:42 -0700 (PDT)
Received: from jazz.hq.newdream.net (localhost [127.0.0.1])
by jazz.hq.newdream.net (Postfix) with ESMTP
id B618F7D; Wed, 11 Sep 2002 06:02:40 -0700 (PDT)
Received: (from william@localhost)
by jazz.hq.newdream.net (8.12.5/8.12.5/Submit) id g8BD1spG067918;
Wed, 11 Sep 2002 06:01:54 -0700 (PDT)
Date: Wed, 11 Sep 2002 06:01:54 -0700 (PDT)
Message-Id: 200209111301.g8BD1spG067918@jazz.hq.newdream.net
X-Authentication-Warning: jazz.hq.newdream.net: william set sender to
asdfasdf@veggiechinese.net using -f
From: asdfasdf@veggiechinese.net
To: asdfasdf@veggiechinese.net
Subject: test
X-Spam-Status: No, hits=1.5 required=5.0 tests=NO_REAL_NAME,FROM_AND_TO_SAME
version=2.20
X-Spam-Level: *

test


#6

Yes, I’ve seen that the “Bcc:” line is removed by the SMTP program that is installed at DreamHost (I think it’s PostFix).

But the standard indicates that other implementations have the option to include the “Bcc:” line (with all the “Bcc:” recipient addresses) in the copies of the message that are sent to the “Bcc:” recipients.

Therefore, it seems that using the “Bcc:” header is not a portable method. Do you agree?


#7

I will have to read it over again, but I believe you’re misunderstanding the RFC. If the Bcc: header were included, it wouldn’t really be Bcc, now would it.

Ok, gave that a quick read. I don’t believe that any system commonly used implements the second way of doing things… Almost certainly The Real Sendmail (as seen in my example) and Postfix both do things the first way.


#8

I think in the interests of simplicity, it will be better to use the “Bcc:” header.

The standard states (in Section 3.4.) that in a group construct, destination headers may be followed by “any number” of mailboxes. Presumably, this applies also to an address list that is not part of a group construct.

Thus, the only question is how to format the list of addresses (as you indicated above) such that they do not exceed the 78 character recommended line length (and/or the 1000 character hard length limit).

Because sendmail reads the message file from the standard input, any questions of memory buffers for the command line are completely avoided.

I think I’ll do that!

–David B.
“greendavid”


#9

This probably doesn’t cover all possible exploits -

You should strip out characters less than 32 ASCII when any user-supplied input is going to appear in the message headers. That will keep the user from adding message headers of his own. Here’s an example that converts tabs to space and removes LF and CR’s in Perl (untested, you’re not going to learn if i do the work for you)

[code]use CGI;

my $cgi = new CGI;

my $from = $cgi->param(‘from_address’);
my $to = $cgi->param(‘to_address’);
my $subject = $cgi->param(‘subject’);

for ($from, $to, $subject) {
s/\0x0A|\0x0D//g; # remove CR and LF
s/\0x09/\0x32/g; # change tab to space
}

print $cgi->header;
print <<MESSAGE;

To: $to
From: $from
Subject: $subject

The messages headers above should only be “To”, “From” and “Subject” with only one linebreak each.

_MESSAGE_

exit;
[/code]