romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 01:43:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

smtp: reject CR and LF in the envelope address

Browse source 
Verified in test 2110

Closes #22119
This commit is contained in:
alhudz 2026-06-21 17:59:09 +05:30 • committed by Daniel Stenberg
parent 8aeef462e3
commit bedeeaa4a7
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 67 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

49
tests/data/test2110 Normal file
View file

@ -0,0 +1,49 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
SMTP
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<server>
smtp
</server>
<name>
SMTP --mail-from with embedded CRLF is rejected
</name>
<file1 name="%LOGDIR/test%TESTNUMBER.eml" crlf="yes">
From: different
To: another
body
</file1>
# read the sender from a config file so the raw CR LF reaches curl intact
# regardless of how the platform passes command line arguments
<file2 name="%LOGDIR/test%TESTNUMBER.config">
mail-from = "sender@example.com\r\nDATA"
</file2>
<command>
smtp://%HOSTIP:%SMTPPORT/%TESTNUMBER --mail-rcpt recipient@example.com -K %LOGDIR/test%TESTNUMBER.config -T %LOGDIR/test%TESTNUMBER.eml
</command>
</client>
# Verify data after the test has been "shot"
<verify>
# 43 - CURLE_BAD_FUNCTION_ARGUMENT
<errorcode>
43
</errorcode>
# the injected DATA command must never reach the server
<protocol crlf="yes">
EHLO %TESTNUMBER
QUIT
</protocol>
</verify>
</testcase>