diff options
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | lib/net/smtp.rb | 9 | ||||
| -rw-r--r-- | test/net/smtp/test_smtp.rb | 47 | ||||
| -rw-r--r-- | version.h | 2 |
4 files changed, 63 insertions, 1 deletions
@@ -1,3 +1,9 @@ +Fri Jun 30 21:10:48 2017 Shugo Maeda <shugo@ruby-lang.org> + + * lib/net/smtp.rb (getok, get_response): raise an ArgumentError when + CR or LF is included in a line, because they are not allowed in + RFC5321. Thanks, Jeremy Daer. + Fri Jun 30 21:07:56 2017 NAKAMURA Usaku <usa@ruby-lang.org> * eval.c (exc_setup_cause): need to unfreeze(=dup) the exception before diff --git a/lib/net/smtp.rb b/lib/net/smtp.rb index d634274c3e..78f2181d2a 100644 --- a/lib/net/smtp.rb +++ b/lib/net/smtp.rb @@ -926,7 +926,15 @@ module Net private + def validate_line(line) + # A bare CR or LF is not allowed in RFC5321. + if /[\r\n]/ =~ line + raise ArgumentError, "A line must not contain CR or LF" + end + end + def getok(reqline) + validate_line reqline res = critical { @socket.writeline reqline recv_response() @@ -936,6 +944,7 @@ module Net end def get_response(reqline) + validate_line reqline @socket.writeline reqline recv_response() end diff --git a/test/net/smtp/test_smtp.rb b/test/net/smtp/test_smtp.rb index 0edb3419d5..3bcceb6fc5 100644 --- a/test/net/smtp/test_smtp.rb +++ b/test/net/smtp/test_smtp.rb @@ -6,6 +6,8 @@ require 'test/unit' module Net class TestSMTP < Test::Unit::TestCase class FakeSocket + attr_reader :write_io + def initialize out = "250 OK\n" @write_io = StringIO.new @read_io = StringIO.new out @@ -51,5 +53,50 @@ module Net assert smtp.rset end + + def test_mailfrom + sock = FakeSocket.new + smtp = Net::SMTP.new 'localhost', 25 + smtp.instance_variable_set :@socket, sock + assert smtp.mailfrom("foo@example.com").success? + assert_equal "MAIL FROM:<foo@example.com>\r\n", sock.write_io.string + end + + def test_rcptto + sock = FakeSocket.new + smtp = Net::SMTP.new 'localhost', 25 + smtp.instance_variable_set :@socket, sock + assert smtp.rcptto("foo@example.com").success? + assert_equal "RCPT TO:<foo@example.com>\r\n", sock.write_io.string + end + + def test_auth_plain + sock = FakeSocket.new + smtp = Net::SMTP.new 'localhost', 25 + smtp.instance_variable_set :@socket, sock + assert smtp.auth_plain("foo", "bar").success? + assert_equal "AUTH PLAIN AGZvbwBiYXI=\r\n", sock.write_io.string + end + + def test_crlf_injection + smtp = Net::SMTP.new 'localhost', 25 + smtp.instance_variable_set :@socket, FakeSocket.new + + assert_raise(ArgumentError) do + smtp.mailfrom("foo\r\nbar") + end + + assert_raise(ArgumentError) do + smtp.mailfrom("foo\rbar") + end + + assert_raise(ArgumentError) do + smtp.mailfrom("foo\nbar") + end + + assert_raise(ArgumentError) do + smtp.rcptto("foo\r\nbar") + end + end end end @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.3.5" #define RUBY_RELEASE_DATE "2017-06-30" -#define RUBY_PATCHLEVEL 326 +#define RUBY_PATCHLEVEL 327 #define RUBY_RELEASE_YEAR 2017 #define RUBY_RELEASE_MONTH 6 |