fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject CRLF/malformed emails and names to stop SMTP header injection

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 18:12:35 +00:00
parent 598234b817
commit 75d3c70cc8
No known key found for this signature in database
6 changed files with 93 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/nickserv/src/set.rs
View file

@ -30,6 +30,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
let email = args.get(2).map(|s| s.to_string());
let cleared = email.is_none();
if let Some(addr) = &email {
if !echo_api::valid_email(addr) {
ctx.notice(me, from.uid, "That doesn't look like a valid email address.");
return;
}
if db.is_forbidden(ForbidKind::Email, addr).is_some() {
ctx.notice(me, from.uid, "That email address is forbidden by network policy. Use a different one.");
return;