diff options
Diffstat (limited to 'src/main.rs')
| -rw-r--r-- | src/main.rs | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/src/main.rs b/src/main.rs index 07fab65..9e2276f 100644 --- a/src/main.rs +++ b/src/main.rs @@ -77,6 +77,11 @@ fn valid_token(h: &HeaderMap, expected: &str) -> bool { got.as_bytes().ct_eq(expected.as_bytes()).into() } +/// Prevent LMTP command executed by the HTTP payload +fn sanitize(v: &str) -> String { + v.chars().filter(|&c| c != '\r' && c != '\n' && c != '>').collect() +} + async fn lmtp_deliver( cfg: &Config, from: &str, @@ -116,14 +121,14 @@ async fn lmtp_deliver( expect!("220"); io!(wr.write_all(b"LHLO localhost\r\n")); expect!("250"); - io!(wr.write_all(format!("MAIL FROM:<{from}>\r\n").as_bytes())); + io!(wr.write_all(format!("MAIL FROM:<{}>\r\n", sanitize(from)).as_bytes())); expect!("250"); - io!(wr.write_all(format!("RCPT TO:<{rcpt}>\r\n").as_bytes())); + io!(wr.write_all(format!("RCPT TO:<{}>\r\n", sanitize(rcpt)).as_bytes())); expect!("250"); io!(wr.write_all(b"DATA\r\n")); expect!("354"); if cfg.rcpt.is_some() { - io!(wr.write_all(format!("X-Original-To: {to}\r\n").as_bytes())); + io!(wr.write_all(format!("X-Original-To: {}\r\n", sanitize(to)).as_bytes())); } for chunk in msg.split_inclusive(|&b| b == b'\n') { |