search

KumoCorp / kumomta

The first Open-Source high-performance MTA developed from the ground-up for high-volume email sending environments.
https://kumomta.com
Apache License 2.0
231 stars 32 forks source link

detect and either error out or fixup trying to use newlines in headers in the http injection api #296

Open wez opened 5 days ago

wez commented 5 days ago

We had a user report issues when trying to do this:

{
  "envelope_sender": "ok@example",
  "content": {
    "subject": "hello\n\nHello there",
    "html_body": "<html>This is the HTML content of the message</html>",
    "text_body": "This is the Text content of the message",
    "from": {
      "email": "ok@example.com",
      "name": "Test"
    },
    "headers": {
      "X-Tenant": "tenant"
    }
  },
  "recipients": [
    {
      "email": "ubuntu@example.com"
    }
  ]
}

the newlines in the subject caused the message body to start in the wrong place and caused issues with the tenant header seemingly not being present.

We should either raise an error for this case, or automatically fixup the newlines in the input so that the header value cannot escape and break the message.

Whichever we choose, we should apply it both to the subject header and any other arbitrary headers that are being passed into the builder.