emersion / emersion/go-message

Unable to parse nested MIME boundaries with the same ids

Open
#164 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
458
Forks
129
PR merge metrics
No merged PRs in 30d

Description

If a message contains nested MIME boundaries, and the inner boundary contains a nested boundary with the same name as the outer boundary, the parser will stop reading when that boundary is closed, regardless if there is more to read.

This is explicitly called out in the [RFC](https://www.rfc-editor.org/rfc/rfc2046#section-5.1):

> As stated previously, each body part is preceded by a boundary
delimiter line that contains the boundary delimiter. The boundary
delimiter MUST NOT appear inside any of the encapsulated parts, on a
line by itself or as the prefix of any line. This implies that it is
crucial that the composing agent be able to choose and specify a
unique boundary parameter value that does not contain the boundary
parameter value of an enclosing multipart as a prefix.

However, I think that the parser should not trust that the composing agent has followed this rule, since you can craft emails without the use of clients that enforce these standards. The parser should maintain context about which boundary its currently in, rather than just the initial boundary, so that they are nested properly, and no data is dropped.

Example:

```
MIME-Version: 1.0

--boundary_outer
Content-Type: multipart/alternative;

--boundary_inner
Content-Type: multipart/alternative;

boundary="boundary_outer" <-- creates a boundary within the `boundary_inner` with the same name as the outer boundary.
type="text/html"

--boundary_outer-- <-- closes the nested boundary with same name, but the parser thinks that the message is over now

--boundary_inner--

--boundary_outer--

```

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start by locating the Go MIME parser and its boundary-state handling, then reproduce the nested same-name boundary from the example; done means the parser continues through the inner closing boundary and does not drop the remaining message content.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.