Max depth for recursive rfc822 messages

[myasoedov]

Hi!

Due to configuring mail server we have created super message that consist recursive answers

• Relay access denied
• No valid recipient

with original copy of message. Message length is 9mb, parts depth is 4000. So:) Total memory for parsing this message is approximately 9mb*4000/2 :)

Of course originally this is not bug of this library, as message is bad, but I suggest to add ability to limit depth here.
https://github.com/mikel/mail/blob/master/lib/mail/attachments_list.rb#L9

Best regards.

require "mail"

# attachment for message
def gen_attachment(boundary)
  "--#{boundary}
Content-Type: text/plain; charset=US-ASCII; name=\"#{boundary}.txt\"
Content-Disposition: attachment; filename=\"#{boundary}.txt\"
Content-Transfer-Encoding: base64

VGhpcyBpcyBhIHRlc3Q=
"
end

# rfc822 delivery message
def gen_rfc822_message(depth, cur_depth=0)
  if cur_depth < depth
    if cur_depth == 0
      return "Content-Type: multipart/report; boundary=\"bound#{cur_depth+1}\"
Subject: test message

root message

#{gen_attachment("bound#{cur_depth+1}")}

#{gen_rfc822_message(depth,cur_depth+1)}

"
    else
      return "--bound#{cur_depth}

Error description HERE

--bound#{cur_depth}
Content-Type: message/delivery-status

Received-From-MTA: DNS; localhost

test delivery status

--bound#{cur_depth}
Content-Type: message/rfc822

Content-Type: multipart/report; boundary=\"bound#{cur_depth+1}\"
Subject: test

encapsulated rfc822 message

#{gen_attachment("bound#{cur_depth+1}")}

#{gen_rfc822_message(depth,cur_depth+1)}

--bound#{cur_depth}--"
    end
  end
  ""
end

message_text = gen_rfc822_message(2000).gsub( /\n/, "\r\n")
message      = Mail.new(message_text)
message.attachments # ;)

[myasoedov]

Also, i think, it will be good to create header length threshold here
https://github.com/mikel/mail/blob/master/lib/mail/field.rb#L115
as we found spam-messages with 18mb header lines.

Best regards. And many thanks for this library.

[jeremy]

Big +1 to sane resource limitations. PR welcome.