Do I need to sanitize a user input textfield used in a mail body?

Question

I have a feature on my site where a user is allowed to edit a textfield is a Drupal form (built using the D7 Form API) and then send the contents of that textfield as (part of) the body of an email to another user. I use drupal_mail to send the mail.

The textfield is saved in the database, and I rely on the Form API to protect against SQL injection. The textfield is never rendered on the screen outside the textfield widget, so "dangerous" HTML tags and PHP/JavaScript injection is not a concern (I hope).

I use DefaultMailSystem as mail backend.

Given that the user can type anything in this textfield, is there any need to sanitize this user input before it is included in the email body and sent?

Answer 1

There are two reasons to use Drupal's text filtering system: security and proper formatting of the information for the context.

In reverse order:

• For formatting: if you use something like the markdown filter or limit with html tags can be used for simple sanity (i.e. no h1) then you want to use a filter that removes that.
• For security: you want to remove malicious code if it is being displayed in an environment where that matters. In the case of email, the relevant DOM is the email client which can sometimes be a domain. However, if it is a security weakness to that email user to get javascript...that is a problem with their client. Since anyone can send any email to any address with any (malformed) contents it is not a major consideration of e-mail processing to ensure the body is "safe" (without scripts). See this discussion on g.d.o/security about sanitizing text in email bodies

That said, you don't want your system to be useful for spam.

• Consider using the flood_control system.
• Consider adding an introduction and closure to your email message to make it less useful for a spammer. For example "This email was sent from example.com. Your friend said: _stuff_here_. If you have questions contact your friend and not example.com"

There is more to e-mail than the body, of course. E-mail headers can be a vector for attacks, since someone can use a newline as part of the "to" address and then append new headers to send as many mails as they want to whomever they want, pretending to be from whoever they want, hurting your domain's reputation in the process.

One other side-note:

The textfield is saved in the database, and I rely on the Form API to protect against SQL injection.

SQL Injection protection should come from proper use of methods and arguments in your db_insert or db_query function. It does not come from the Form API.

Answer 2

It depends on the mail backend you are using. DefaultMailSystem perform basic sanitization on send, but it cares only about mail specification and ignores the fact that body might be HTML - that's on you. So you are guaranteed what you send will be formally valid e-mail, but not that it will be valid HTML. Exact part about body sanitization is:

// Note: e-mail uses CRLF for line-endings. PHP's API requires LF
// on Unix and CRLF on Windows. Drupal automatically guesses the
// line-ending format appropriate for your system. If you need to
// override this, adjust $conf['mail_line_endings'] in settings.php.
$mail_body = preg_replace('@\r?\n@', $line_endings, $message['body']);

And that's it, as mail is pretty accepting format and sets stricter requirements on other fields - NOT on body.

Using drupal_mail() is safer than using backend directly, as it calls format method:

// Format the message body.
$message = $system->format($message);

And default's format method strips the HTML:

  // Convert any HTML to plain-text.
  $message['body'] = drupal_html_to_text($message['body']);

The big question is - how much do you trust drupal_html_to_text()? It is there to made text valid, but it never claims it is a safeguard against malicious misuse. As far as I understand it's code, it should be reasonably safe in most cases, but as far as I remember there was some link related holes in mail readers that could be abused anyway.

TL;DR Basic sanitisation is done but there still might be some attacks possible.