Dear Maintainer,

There is some curious code in Mail.pm:

    for my $recipient ($param{parse_for_recipients}?q(-t):(),@recipients)
        eval {
            _send_message($param{message},@sendmail_arguments,$recipient);

As you can see, it sometimes sets $recipient="-t" to modify how
sendmail works. While clever, it suggests a possible security problem.
In particular, a recipient address may be interpreted as an option
flag. For example,

    sendmail -oem -oi -oQ/tmp/should-not-exist-marker@example.com foo@bar.com

I am not running debbugs, so I cannot confirm that this weakness is
exploitable, but I am able to simulate it using t/lib/DebbugsTest.pm.
Please see the attached test file, t/24_recipient_injection.t, that
demonstrates the problem. (Run it using `prove -l t/24_*`).

I believe the correct solution is to add "--" in the two places in
lib/Debbugs/Mail.pm which call _send_message(). Please see the second
attachment which includes the fix. Once applied, `prove` will succeed.

The third patch file is optional but useful as it causes
t/lib/DebbugsTest.pm to create properly named tempdirs.

Thank you,

This is assuming that debbugs does not validate recipient addresses before that
point, yes ?

Cheers,

On Sun, 05 Jul 2026, Ben Wong wrote:n

Yeah, this is something we should fix, since you could have a mail
address starting with -. Not sure exactly if sendmail parses that
correctly.

The patch has some extraneous changes and should be simplified a bit (we
should put -t into @sendmail_arguments instead, or have it use -t when
there isn't any recipients instead of calling the same code twice.)

I'll look into this later on today.