jhickner / smtp-mail

Making it easy to send SMTP email from Haskell
BSD 3-Clause "New" or "Revised" License
75 stars 32 forks source link

Dangerous missing error handling in auth code #18

Open TimWolla opened 8 years ago

TimWolla commented 8 years ago

My mail server accepts AUTH only after STARTSSL and replies with 530 5.7.0 Must issue a STARTTLS command first otherwise. But this error message is ignored in sendCommand, which leads to the library happily continue sending the username and password over the wire in plaintext, which will be interpreted as commands, leading to: 502 5.5.2 Error: command not recognized.