Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Safeguard subject property (and others) against SMTP CRLF injection attacks #88

Closed
bbottema opened this issue Aug 9, 2017 · 1 comment
Closed

Safeguard subject property (and others) against SMTP CRLF injection attacks #88

bbottema opened this issue Aug 9, 2017 · 1 comment
Assignees
@bbottema
Labels
major feature Priority-Low security
Milestone
4.3.0

Comments

@bbottema
Copy link
Owner

bbottema commented Aug 9, 2017 •
edited
Loading

It is possible to set a subject which contains newlines and custom SMTP protocol directives which directly sets the body of the email. This can be an issue when the subject comes from an external resource.

As a matter of precaution, Simple Java Mail should simply remove newline characters from all values (except for the body).

Also see:
@bbottema bbottema added this to the 4.3.0 milestone Aug 9, 2017
bbottema added a commit that referenced this issue Aug 12, 2017
@bbottema
#88 Added validation checks for suspicious injection characters. Chec…
12aac84 
…king the entire email (except for the DKIM properties)
@bbottema bbottema self-assigned this Aug 12, 2017
@bbottema bbottema changed the title Subject property (and possible others) can be abused for injection attacks Safeguard subject property (and others) against SMTP CRLF injection attacks Aug 12, 2017
@bbottema
Copy link
Owner Author

Released in 4.3.0.

@bbottema bbottema mentioned this issue Mar 9, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@bbottema bbottema

Labels
major feature Priority-Low security
Projects
None yet
Milestone
4.3.0
Development

No branches or pull requests
1 participant
@bbottema