[Users] That won't work.

[claws at dragony.name]

>So in my view allowing to pass usanitized header to a shell is a bug no
>matter how you look at it. Either Claws should sanitize the string or it
>should use an exec* mutation that does not use use the shell but passes
>the argument verbatim.

/sign

>However, if the whole message is passed on the standard input of the
>executed process as the pipe symbol suggests the process is in the
>position to read all headers and there is no need to pass any as
>arguments.

That would also be a great way of solving all sort of problems. However one must be aware that e-mail exist out there having several hundreds MB in size. When we talk about e-mails, we usually think about short text messages. So I suggest passing only header data to STDIN of the external program when using |p.

My favourite solution would be the exec* mutation. It sounds cool and secure! :D

- Dragony