Re: [EAI] draft-leiba-5322upd-from-group discussion

[Barry Leiba <[e-mail]>]

>>    If the from field contains more than one address in the address-list,
>>    then the sender field, containing the field name "Sender" and a
>>    single mailbox specification, MUST appear in the message.
>
>> I don't believe that we plan to use the "Sender" field in the cases
>> where we'll use group syntax in "From", so that MUST can't stay.
>
> Then I guess I'm confused. The cases I'm familiar with in EAI at least involve
> constructing empty groups. The text says "more than one", not "anything
> other than one", so the MUST would not be violated.
>
> If there's a use-case for creating a From: field using a group that
> ends up containing multiple addreseses, I'd like to know what it is so I can
> evaluate whether it warrants overrding the MUST.

Hm, good point.  The text in question was written with the idea of
"from" being mailboxes, and it's not clear that the sender always
knows how groups will expand.

But now that you say this, I think we can consider that a "group" is a
single "address" (as opposed to a multi-address list), and so we can
leave that paragraph as is, with the MUST.  And so I don't think this
is a problem.  Does anyone think otherwise?

>> Please also review the Security Considerations, and make sure I got that
>> right.
>
> The one I don't see is possible exploits involving different clients handling
> of something that used to not be allowed.

Good point; I'll craft something for that and post an updated draft.

b