I wouldn't expect Joomla\CMS\String\PunycodeHelper::emailToPunycode to process multiple addresses since the API was clearly designed there for a one-to-one process. Joomla\CMS\Filter\InputFilter::emailToPunycode would be the place that needs to have this logic since it is very clearly filtering the content it is given based on finding a mailto.

With that said though, personally I'd be careful about supporting this. I'm finding conflicting guidance on whether mailto URI schemes should actually support multiple addresses in this manner.

It is definitely wrong to have multiple to addresses in the link. If you need to then you should be using cc or bcc (no idea if thats supported or not)

It would be better to use a forwarding/group email address than exposing these email addresses.

I wouldn't expect Joomla\CMS\String\PunycodeHelper::emailToPunycode to process multiple addresses since the API was clearly designed there for a one-to-one process. Joomla\CMS\Filter\InputFilter::emailToPunycode would be the place that needs to have this logic since it is very clearly filtering the content it is given based on finding a mailto.

@mbabker - I intended to update this today after a re-think last night. This issue was the last thing I did before logging off yesterday.

So the target for this issue should be Joomla\CMS\Filter\InputFilter::emailToPunycode

I'm finding conflicting guidance on whether mailto URI schemes should actually support multiple addresses in this manner.

There is nothing in rfc2368 that explicitly forbids the use of multiple email addresses in the link, and the Wikipedia entry for mailto includes an example - https://en.wikipedia.org/wiki/Mailto - citing rfc6068 which also includes an example with multiple email addresses.

Form the point of view of the API, one could insist on restricting the syntax to a single email address, with others added using cc, but this is a user issue, not a developer one, and as this works in desktop email clients, users expect it to work in other situations too.

rfc2822

The destination fields specify the recipients of the message. Each destination field may have one or more addresses, and each of the addresses indicate the intended recipients of the message. The only difference between the three fields is how each is used.

The "To:" field contains the address(es) of the primary recipient(s) of the message.

Updated issue title to reference Joomla\CMS\Filter\InputFilter::emailToPunycode

My comment above was wrong

Thank you for raising this issue.

Joomla 3 is now in security only mode with no further bug fixes or new features.

This is still an issue in Joomla 4 so I am asking gor the label to be updated to Joomla 4 and maybe someone will be interested in fixing it.

PunycodeHelper::emailToPunycode was not deigned for that
so that's imho not an issue
but as for https://www.rfc-editor.org/rfc/rfc2822#section-3.6.3
a nice to have
i'll move it to discussion