Fwd: BUG: imapd 2.2.3 (virtual domain support)

[Rob Siemborski]

On Tue, 2 Mar 2004, Stephan Buys wrote:

> We just wanted to let you know that we have discovered a bug in Cyrus IMAPd
> with it's handling of Virtual Domains.

I wouldn't call this a bug, I'd call it a reasonable behavior given the
server administrator's choice to support virtual domains.  A server is
always free to disallow the creation of a mailbox if it doesn't like its
name (Indeed, "INBOX/../../../../vmlinux" is a valid name, but I doubt
anyone would think it would be correct to allow -- especially on systems
where the unix filesystem is directly involved).

Note that this does not affect systems where virtual domains are not
enabled:

S: * OK mail-fe6.andrew.cmu.edu Cyrus IMAP4 Murder v2.2.2-BETA-082 server
ready
C: C01 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ MAILBOX-REFERRALS
NAMESPACE UIDPLUS ID NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY
SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES ANNOTATEMORE STARTTLS
AUTH=KERBEROS_V4 AUTH=GSSAPI
AUTH=ANONYMOUS SASL-IR
S: C01 OK Completed
C: A01 AUTHENTICATE KERBEROS_V4
...
S: A01 OK Success (privacy protection)
Authenticated.
Security strength factor: 56
x create inbox.foo at bar
x OK Completed
y delete inbox.foo at bar
y OK Completed

In the virtual domains configration, the administrator has made the
explicit choice that the benefit of virtual domains outweighs the loss of
@ as a valid mailbox character.  Certainly, no client should rely on
the ability to "escape" for special characters within a mailbox name
(other than via UTF-7).

-Rob

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rob Siemborski * Andrew Systems Group * Cyert Hall 207 * 412-268-7456
Research Systems Programmer * /usr/contributed Gatekeeper

---
Home Page: http://asg.web.cmu.edu/cyrus
Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html