From: Richard Turner <richard.turner@...>
Date: 2005-04-06T20:21:42+09:00
Subject: Net::SMTP/mod_ruby SecurityError

Hi,

I have an application that uses mod_ruby and I need to be able to have
it email a message to an address specified by a user using a web form. I
seem to have everything set-up fine, I run the entered email address
through a validation process before continuing so I'm confident it's
safe to untaint it, but sendmessage() still raises a SecurityError.

Is this something simple I'm doing wrong or is the problem a little more
exotic?

Thanks for any help.

Cheers,

Richard.

Code:

def emailReportTo(email, report)
  require 'net/smtp'
    
  unless validated(email)
    return
  end
    
  msg = <<EOS
From: my.email@home
To: #{email}
Subject: Report

EOS
  msg += report
    
  Net::SMTP.start('localhost', 25) do |smtp|
    smtp.send_message(msg, 'my.email@home', email.untaint)
  end
end