ronomon/mime
View on GitHub ↗ ★ 63 JavaScript
Fast, robust, standards-compliant MIME decoder. Ships with extensive tests and fuzz tests.
10 mentions on Hacker News by 2 people: 3 stories, 7 comments · first 2017-05-22 · latest 2020-04-22
20082026
-
I wrote @ronomon/mime ( https://github.com/ronomon/mime ) as a strict fuzz-tested MIME parser in a memory-safe language to prevent similar attacks such as: 1. Malicious character encodings that can crash email clients such as Apple Mail.…
comment by jorangreef · 2020-04-22 · in You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild -
…traversals, malicious continuation indices, truncated MIME messages, stack overflows etc. [1] https://github.com/ronomon/mime [2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin... [3] https://blog.cotten.io/ghost-emails-hackin…
comment by jorangreef · 2019-08-08 · in The Fully Remote Attack Surface of the iPhone -
That is an interesting approach. Care to let us know how you go from https://github.com/ronomon/mime to some kind of SMTP server plugin (like for postfix for example)?
comment by readingnews · 2019-02-19 · in A Plan for Spam (2002) -
…Gmail etc. will have no problem with, but which are obviously broken. For example, we use our own https://github.com/ronomon/mime to detect and reject email which has missing multi-parts (no terminating boundary delimiter). All of this has…
comment by jorangreef · 2019-02-19 · in A Plan for Spam (2002) -
…email client. A summary of these vectors are listed in the README (amongst various sanity checks): https://github.com/ronomon/mime#robust Just through checking everything about an email carefully, @ronomon/mime has detected and brought to…
comment by jorangreef · 2018-11-15 · in Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector -
…Just recently even, it kept me back from what might have been a potential denial of service in https://github.com/ronomon/mime , and lead to discovering a vulnerability in several popular email parsers (…
comment by jorangreef · 2018-09-05 · in Latency Numbers Every Programmer Should Know -
…is interested in general MIME validation, not specifically email addresses, I wrote @ronomon/mime: https://github.com/ronomon/mime The source code has comments from the various RFCs inline. It's not just a question of reading and knowing…
comment by jorangreef · 2018-02-12 · in Validating email addresses: A journey down RFC5321 [video]