mox/message
Mechiel Lukkien 1f9b640d9a
add faq for smtp smuggling, fix bug around handling "\nX\n" for any X, reject bare carriage returns and possibly smtp-smuggling attempts
mox was already strict in its "\r\n.\r\n" handling for end-of-message in an
smtp transaction.

due to a mostly unrelated bug, sequences of "\nX\n", including "\n.\n" were
rejected with a "local processing error".

the sequence "\r\n.\n" dropped the dot, not necessarily a big problem, this is
unlikely to happen in a legimate transaction and the behaviour not
unreasonable.

we take this opportunity to reject all bare \r.  we detect all slightly
incorrect combinations of "\r\n.\r\n" with an error mentioning smtp smuggling,
in part to appease the tools checking for it.

smtp errors are 500 "bad syntax", and mention smtp smuggling.
2024-01-01 20:11:16 +01:00
..
authresults.go when generating Authentication-Results, put each method on a new line for better readability 2023-12-14 20:20:17 +01:00
authresults_test.go when generating Authentication-Results, put each method on a new line for better readability 2023-12-14 20:20:17 +01:00
compose.go change the message composing code from webmail over to message.Composer too 2023-11-09 21:15:27 +01:00
decode.go expose fewer internals in packages, for easier software reuse 2023-12-14 15:39:36 +01:00
decode_test.go expose fewer internals in packages, for easier software reuse 2023-12-14 15:39:36 +01:00
doc.go mox! 2023-01-30 14:27:06 +01:00
examples_test.go add more documentation, examples with tests to illustrate reusable components 2023-12-14 20:20:17 +01:00
from.go switch to slog.Logger for logging, for easier reuse of packages by external software 2023-12-14 13:45:52 +01:00
hdrcmtdomain.go add webmail 2023-08-07 21:57:03 +02:00
headerwriter.go when generating Authentication-Results, put each method on a new line for better readability 2023-12-14 20:20:17 +01:00
messageid.go expose fewer internals in packages, for easier software reuse 2023-12-14 15:39:36 +01:00
messageid_test.go implement message threading in backend and webmail 2023-09-13 15:44:57 +02:00
parseheaderfields.go add more documentation, examples with tests to illustrate reusable components 2023-12-14 20:20:17 +01:00
parseheaderfields_test.go implement message threading in backend and webmail 2023-09-13 15:44:57 +02:00
part.go add more documentation, examples with tests to illustrate reusable components 2023-12-14 20:20:17 +01:00
part_test.go expose fewer internals in packages, for easier software reuse 2023-12-14 15:39:36 +01:00
qp.go add more documentation, examples with tests to illustrate reusable components 2023-12-14 20:20:17 +01:00
readheaders.go mox! 2023-01-30 14:27:06 +01:00
referencedids.go implement message threading in backend and webmail 2023-09-13 15:44:57 +02:00
referencedids_test.go switch to slog.Logger for logging, for easier reuse of packages by external software 2023-12-14 13:45:52 +01:00
threadsubject.go add more documentation, examples with tests to illustrate reusable components 2023-12-14 20:20:17 +01:00
threadsubject_test.go implement message threading in backend and webmail 2023-09-13 15:44:57 +02:00
time.go tweak time format for added date headers 2023-06-04 21:04:10 +02:00
todo.go mox! 2023-01-30 14:27:06 +01:00
writer.go add faq for smtp smuggling, fix bug around handling "\nX\n" for any X, reject bare carriage returns and possibly smtp-smuggling attempts 2024-01-01 20:11:16 +01:00
writer_test.go add faq for smtp smuggling, fix bug around handling "\nX\n" for any X, reject bare carriage returns and possibly smtp-smuggling attempts 2024-01-01 20:11:16 +01:00