bug#47616: 27.1; hardening mail-envelope-from

[Francesco Potortì]

>Francesco Potortì <pot@gnu.org> writes:
>> Hardening mail-envelope-from from sendmail.el by narrowing to the
>> headers, as the doc says, corrects the problem that I observed.
>
>Thanks -- I don't think we should change mail-envelope-from itself here,
>because it may conceivably be called from other contexts.  Instead the
>callers in sendmail/smtpmail should be altered to narrow to the headers
>before calling it, and I've now done this in Emacs 28.  (This uncovered
>a similar bug in smtpmail.el, too.)

That makes sense, in principle.  I would argue for adding a comment to
mail-envelope-from stating that since it calls mail-fetch-field it
should be called only after narrowing to the headers.  Or maybe even
adding a note in the doc string, as done in mail-fetch-field.