PHP mail() Header Injection Prevention

Question

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution but I'm not satisfied with it. Is there a built in header sanitation function? What would one need to do to really protect against this sort of attack?

Answer 1

As a matter of fact PHP includes a function to check the validity of a provided address.

http://php.net/manual/en/function.filter-var.php

http://www.php.net/manual/en/filter.filters.validate.php

Ex: filter_var($_POST['from'], FILTER_VALIDATE_EMAIL) ? send() : die("You murdered me. D:");

Answer 2

This is how pear does it in their Mail package:

function _sanitizeHeaders(&$headers)
{
    foreach ($headers as $key => $value) {
        $headers[$key] =
            preg_replace('=((<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*=i',
                         null, $value);
    }
}

Obviously, for this method to be adapted to work with the built-in mail() function, some work will need to be done. Instead of working with associative arrays for headers, the mail() function just accepts a string. So you (the user of mail()) would have to sanitize each piece of the header similar to the above as you build up the headers string.

I'd like to hear in the comments if this indeed covers every injection threat (from those that are more experienced with issues like this).

Answer 3

Clearly you can never trust data from users. The solution is not to rely on convinient sanitizing in the header function, but instead never trust DIRTY data from your users.

No matter when and how, but if your data is coming from outside you need to clean it. In this example a simple / would escape the /n character, and the attack would not work.