来自电子邮件地址的硬编码是否避免了昨天宣布的PHPMailer漏洞？

Question

The announcement I am referring to was posted at: http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html

I have used code like this in many websites:

$mail = new PHPMailer(true);
$mail->SetFrom('[e-mail]', 'My Site');
$mail->AddReplyTo( $contact_email, "$contact_name" );
$mail->Subject = $subject;
$mail->AltBody = $mail_text;
$mail->MsgHTML($mail_html);
$result = $mail->Send();

Am I safe from the vulnerability because my from address is hard-coded? Should I worry about the reply-to address, which comes from user input? I do validate it with filter_var, but if I understand correctly, a from address can pass validation and still inject code because spaces are technically allowed in email addresses.

Answer 1

Yes, you are safe.

As Sammitch said, you should never use a user-supplied from address anyway because it will be forgery and you will fail SPF checks. This is mentioned in the PHPMailer docs and in many answers on SO.