exim icon indicating copy to clipboard operation
exim copied to clipboard

Escape quotation marks when logging SMTP strings

Open nomis opened this issue 2 years ago • 0 comments

The SMTP command buffer and various other messages logged inside smtp_in.c are wrapped in quotes. If the content contains quotes it becomes very difficult to parse the log correctly because the quoted section can be ended prematurely.

This happens if someone sends JSON to Exim (attempting to exploit a non-SMTP service) with a string like:

{"hello": ["world"]}

The distinguished name and possibly other externally supplied strings enclosed in quotes could also contain quotes.

nomis avatar Nov 08 '22 21:11 nomis