search

haraka / Haraka

A fast, highly extensible, and event driven SMTP server
https://haraka.github.io
MIT License
5.09k stars 662 forks source link

possible info leak? #917

Closed celesteking closed 9 years ago

celesteking commented 9 years ago

I'm against this line: connection.notes.auth_passwd = credentials[1];

smfreegard commented 9 years ago

And your reasoning is? It's used for this https://github.com/baudehlo/Haraka/blob/master/plugins/prevent_credential_leaks.js

Feel free to remove it from your own fork.

celesteking commented 9 years ago

The reasoning is possibility of password sniffing via rogue plugin that interprets user data. But I'm just theorizing.