exim
exim copied to clipboard
Escape quotation marks when logging SMTP strings
The SMTP command buffer and various other messages logged inside smtp_in.c are wrapped in quotes. If the content contains quotes it becomes very difficult to parse the log correctly because the quoted section can be ended prematurely.
This happens if someone sends JSON to Exim (attempting to exploit a non-SMTP service) with a string like:
{"hello": ["world"]}
The distinguished name and possibly other externally supplied strings enclosed in quotes could also contain quotes.