fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject CRLF/malformed emails and names to stop SMTP header injection

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 18:12:35 +00:00
parent 598234b817
commit 75d3c70cc8
No known key found for this signature in database
6 changed files with 93 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/nickserv/src/register.rs
View file

@ -22,6 +22,12 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
}
}
let email = args.get(2).map(|s| s.to_string());
if let Some(addr) = &email {
if !echo_api::valid_email(addr) {
ctx.notice(me, from.uid, "That doesn't look like a valid email address.");
return;
}
}
ctx.defer_register(from.nick, *password, email, RegReply::NickServ {
agent: me.to_string(),
uid: from.uid.to_string(),

4
modules/nickserv/src/set.rs
View file

@ -30,6 +30,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
let email = args.get(2).map(|s| s.to_string());
let cleared = email.is_none();
if let Some(addr) = &email {
if !echo_api::valid_email(addr) {
ctx.notice(me, from.uid, "That doesn't look like a valid email address.");
return;
}
if db.is_forbidden(ForbidKind::Email, addr).is_some() {
ctx.notice(me, from.uid, "That email address is forbidden by network policy. Use a different one.");
return;