From: Vsevolod Stakhov Date: Thu, 16 Jul 2026 11:28:23 +0000 (+0100) Subject: [Fix] Split MIME address lists on semicolons as well as commas X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=41c46e9c9b985e065ef3bf84cd6de08587f221ab;p=thirdparty%2Frspamd.git [Fix] Split MIME address lists on semicolons as well as commas A semicolon is not an RFC 5322 address-list separator (it only terminates a group construct), but Outlook-style ;-separated recipient lists are pervasive in real mail and most MTAs (e.g. Postfix) split them. Previously such a list was parsed as a single malformed address whose local part swallowed the semicolon and the next address, breaking recipient counts and producing false invalid-address signals. Treat ';' exactly like ',' in the list parser. This mirrors the existing comma behaviour in every edge case: semicolons inside quoted strings are preserved, an unquoted semicolon in a display name drops the preceding phrase just like a comma does, an empty group (undisclosed-recipients:;) now yields no addresses like the comma variant, and the trailing ';' of a group construct no longer leaks into the last member's domain. Issue: #6139 --- diff --git a/src/libmime/email_addr.c b/src/libmime/email_addr.c index c3af21f9f2..fccf56d483 100644 --- a/src/libmime/email_addr.c +++ b/src/libmime/email_addr.c @@ -376,7 +376,14 @@ rspamd_email_address_from_mime(rspamd_mempool_t *pool, const char *hdr, c = p; state = parse_addr; } - else if (*p == ',') { + else if (*p == ',' || *p == ';') { + /* + * Semicolon is not an RFC 5322 list separator (it merely + * terminates a group construct), but Outlook-style + * `;'-separated address lists are pervasive in real mail and + * are split by most MTAs, so treat it exactly like a comma; + * a `;' inside a quoted string is handled by parse_quoted + */ if (p > c && seen_at) { /* * Last token must be the address: