title: Comments in display names are incorrectly handled in net/mail
description: The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
problem types: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
affected:
{
vendor: Go standard library
product: net/mail
collectionURL: https://pkg.go.dev
packageName: net/mail
versions:
version: 0, lessThan: 1.21.8, status: affected, versionType: semver
version: 1.22.0-0, lessThan: 1.22.1, status: affected, versionType: semver
programRoutines:
name: addrParser.consumeGroupList
name: addrParser.consumePhrase
name: isAtext
name: Address.String
name: AddressParser.Parse
name: AddressParser.ParseList
name: Header.AddressList
name: ParseAddress
name: ParseAddressList
defaultStatus: unaffected
}