MimeComplianceOptionsMaxIssuesPerViolation Property

Get or set the maximum number of times that each compliance violation may be reported.

Definition

Namespace: MimeKit
Assembly: MimeKit.Core (in MimeKit.Core.dll) Version: 5.0.0
C#
public int MaxIssuesPerViolation { get; set; }

Property Value

Int32
The maximum number of times that each violation may be reported, or 0 for no limit.

Remarks

Gets or sets the maximum number of times that each compliance violation may be reported during a single parse operation. The default is 0, which means that no limit is applied.

The number of issues a message can produce is bounded only by its size, and the densest forms cost only a few bytes per issue, so a message built for the purpose can produce issues far faster than anything downstream can afford to record them. Setting a limit is recommended when parsing untrusted messages.

The limit is per violation rather than a single total for the message. A total budget would itself be exploitable: a message could open with a flood of cheap, harmless violations and place the interesting ones after the point where the budget is known to run out. Giving each violation its own budget means that no violation can crowd out any other, while still bounding the total at the number of distinct violations times this value.

When some violation reaches the limit, a single TooManyComplianceIssues issue is reported so that the report is never silently incomplete.

Example

C# 
                    // IMimeComplianceLogger receives a MimeComplianceIssue for each violation of the MIME
// specifications that the MimeReader (or MimeParser) encounters while parsing.
class ComplianceReport : IMimeComplianceLogger
{
    public readonly List<MimeComplianceIssue> Issues = new List<MimeComplianceIssue> ();

    public void Log (in MimeComplianceIssue issue)
    {
        Issues.Add (issue);
    }
}

public static MimeMessage ParseAndReportCompliance (string fileName)
{
    using (var stream = File.OpenRead (fileName)) {
        var report = new ComplianceReport ();
        var parser = new MimeParser (stream, MimeFormat.Entity) {
            ComplianceLogger = report,

            // Messages from a local message store (such as an mbox or Maildir) are not
            // subject to the transport requirements (such as line-length limits) and so
            // such violations are rated with a lower severity.
            ComplianceContext = MimeComplianceContext.Storage,

            // When parsing untrusted messages, limit the number of times that each violation
            // may be reported to avoid unbounded memory usage.
            MaxComplianceIssuesPerViolation = 100
        };

        var message = parser.ParseMessage ();

        foreach (var issue in report.Issues) {
            // Each issue includes the location in the stream where the violation was found,
            // how severe it is, and a description of the problem.
            Console.WriteLine ("[{0}] line {1}, column {2}: {3}", issue.Severity, issue.LineNumber, issue.ColumnNumber, issue.Description);

            // The Categories property describes the kinds of risk that the violation poses.
            if ((issue.Categories & MimeComplianceCategories.Security) != 0)
                Console.WriteLine ("    This violation may have security implications: {0}", issue.Remarks);
        }

        return message;
    }
}

Exceptions

ArgumentOutOfRangeException value is negative.

See Also