i do not think that we can ask for the shell's help with metacharacter
expansion, because even on unix, the syntax it understands may not be
what the user expects.
because i call sendmail from popen() in cron, i had this problem with
MAILTO= values. i first decided to accept only @, %, ::, and %. but then
people with strange login shells or strange non-posix /bin/sh
implementations reported trouble. now i allow isalnum() only, and if
they want something else, they can put it in /etc/aliases or whatever.
for MH we should allow only metacharacters we handle explicitly, and we
should use strsep() rather than /bin/sh to make our argument vectors,
and we should call execve() rather than popen().
in other words, the reason this is hard to do, is that it's a bad idea.
vixie
--
Nmh-workers
https://lists.nongnu.org/mailman/listinfo/nmh-workers