mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-10-08 05:17:15 +00:00
generateMessageID: appended the substring following the last '@' without sanitizing it, so a sender value such as 'Doe, John <a@b>' produced 'Message-Id: <uuid@b>>' with a duplicated closing bracket on calendar invitations. A nil domain also left the message-id unterminated. The domain part is now cut at the first address delimiter or whitespace - a domain is a single token, and anything else would allow header injection through generated message-ids. Fixes #6201