jhillyerd / enmime / 27069273966

86%

main: 86%

Build Type

Pull #398

github

Committed by jhillyerd

Commit Message

fix: decouple internal/textproto from net/textproto, apply CVE-2026-42507

The vendored internal/textproto package was importing net/textproto
and using its ProtocolError and Error types. This undermined the
purpose of vendoring, as Go 1.26's CVE-2026-42507 fix changed
Error.Error() to quote the Msg field, breaking test expectations.

Define local ProtocolError and Error types to insulate against
upstream breaking changes, then apply the same CVE fix locally:
- Escape arbitrary input in ProtocolError messages using %q
- Quote Error.Msg in Error.Error() output

Compatible with all Go versions.

Pull Request Pull Request #398: fix: apply CVE-2026-42507 escaping to internal/textproto

Coverage Stats

10 of 19 new or added lines in 3 files covered. (52.63%)

60 existing lines in 3 files now uncovered.

3285 of 3803 relevant lines covered (86.38%)

4319.37 hits per line