go-pkgz / email / 32195200143

93%

Build Type

push

github

Committed by web-flow

Commit Message

Reject header injection and report smtp delivery failures (#27)

* Reject CR and LF in email header values

Previously, From, To, Subject, UnsubscribeLink and InReplyTo were copied
into the generated message as is, so a value with CR or LF terminated its
header and let the caller's input add arbitrary headers and a body of its
own. With a user-supplied recipient address that means an attacker chooses
the subject and the HTML body of a message sent from the configured sender.

After this change, buildMessage validates every user-provided header value
and Send builds the message before it connects, so a rejected message never
reaches the server.

* Report smtp delivery failures and close attachment files on error paths

Previously, the error from closing the message writer was only logged, and
net/smtp reports the final response to the DATA command exactly there, so
a message rejected by the server for policy, quota or size was reported to
the caller as sent. After this change, the error is returned and Quit is
skipped for a message the server did not accept.

Per-file work in writeFiles moved into its own function, so an attachment
is closed when reading, part creation, seeking or encoding fails, not only
on the success path.

* Keep closing a client set with the SMTP option on early returns

Validating the recipients and building the message before the connection
moved those returns above the deferred cleanup, so a client injected with
the SMTP option was left open when there were no recipients or the message
could not be built, against the documented "always closes client" contract.

The cleanup is installed first now, and the client is still made only after
the message is built, so a bad message still opens no connection.

Coverage Stats

73 of 77 new or added lines in 1 file covered. (94.81%)

2 existing lines in 1 file now uncovered.

338 of 359 relevant lines covered (94.15%)

17.21 hits per line