smtp: reject CR and LF in the envelope address#22119
Conversation
|
Analysis of PR #22119 at 989e13f7: Test 2110 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 120 different CI jobs (the link just goes to one of them). Generated by Testclutch |
989e13f to
97fb325
Compare
|
The test2110 failure was real, thanks. On the Windows/cygwin/msys runners the embedded CR LF got collapsed to a space by the platform argv handling before it ever reached curl, so Reworked the test to pass the sender through a |
97fb325 to
b942a3e
Compare
Can you take a look and force-push? |
Repro: point
--mail-from(or--mail-rcpt) at an address holding a real CR/LF, e.g.sender@example.comfollowed by%0d%0athenDATA. The server receives the smuggledDATAas its own command line.Cause:
smtp_parse_address()copies the address straight into theMAIL FROM:/RCPT TO:line throughCurl_pp_sendf()with no control-byte check. Each SMTP command is one CRLF-terminated line, so an embedded CR or LF in the address splits the line and injects further commands.Fix: reject a CR or LF in
smtp_parse_address(), the shared parser behindMAIL FROM,RCPT TO,AUTHandVRFY/EXPN, before the command is built. Other curl protocol fields built from a single value already refuse control octets; the SMTP envelope addresses did not.test2110covers it: before the change the injected line reaches the server, after itcurlfails withCURLE_BAD_FUNCTION_ARGUMENTand onlyEHLO/QUITgo out.