romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-10 23:27:21 +03:00
Code Issues Projects Releases Packages Wiki Activity

smtp: reject CR and LF in the envelope address

Browse source 
Verified in test 2110

Closes #22119
This commit is contained in:
alhudz 2026-06-21 17:59:09 +05:30 • committed by Daniel Stenberg
parent 8aeef462e3
commit bedeeaa4a7
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 67 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/data/Makefile.am
View file

@ -254,7 +254,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 test2109 test2113 \
test2108 test2109 test2110 test2113 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \

49
tests/data/test2110 Normal file
View file

@ -0,0 +1,49 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
SMTP
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<server>
smtp
</server>
<name>
SMTP --mail-from with embedded CRLF is rejected
</name>
<file1 name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
From: different
To: another
body
</file1>
# read the sender from a config file so the raw CR LF reaches curl intact
# regardless of how the platform passes command line arguments
<file2 name="%LOGDIR/test%TESTNUMBER.config">
mail-from = "sender@example.com\r\nDATA"
</file2>
<command>
smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com -K %LOGDIR/test%TESTNUMBER.config -T %LOGDIR/test%TESTNUMBER.eml
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 43 - CURLE_BAD_FUNCTION_ARGUMENT
<errorcode>
43
</errorcode>
# the injected DATA command must never reach the server
<protocol crlf="yes">
EHLO %TESTNUMBER
QUIT
</protocol>
</verify>
</testcase>