Prepare 0.9.6 (#630)

Co-authored-by: Paolo Barbolini <paolo@paolo565.org>

CHANGELOG.md

@@ -1,3 +1,27 @@
+<a name="v0.9.6"></a>
+### v0.9.6 (2021-05-22)
+
+#### Bug Fixes
+
+* **transport**
+  * **SECURITY**: Prevent SMTP command injection in smtp transport
+
+<a name="v0.9.5"></a>
+### v0.9.5 (2020-11-11)
+
+#### Bug Fixes
+
+* **transport**
+  * **SECURITY**: Prevent argument injection in sendmail transport
+
+<a name="v0.9.4"></a>
+### v0.9.4 (2020-04-21)
+
+#### Bug Fixes
+
+* **email**
+  * Go back to `rust-email` 0.0.20 as upgrade broke message formatting ([6a40f4a](https://github.com/lettre/lettre/commit/6a40f4a)
+
 <a name="v0.9.3"></a>
 ### v0.9.3 (2020-04-19)
 

lettre/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 
 name = "lettre"
-version = "0.9.3" # remember to update html_root_url
+version = "0.9.6" # remember to update html_root_url
 description = "Email client"
 readme = "README.md"
 homepage = "http://lettre.at"

lettre/src/lib.rs

@@ -3,7 +3,7 @@
 //! This mailer contains the available transports for your emails.
 //!
 
-#![doc(html_root_url = "https://docs.rs/lettre/0.9.3")]
+#![doc(html_root_url = "https://docs.rs/lettre/0.9.6")]
 #![deny(
     missing_copy_implementations,
     trivial_casts,

lettre/src/sendmail/mod.rs

@@ -50,6 +50,7 @@ impl<'a> Transport<'a> for SendmailTransport {
                     .map(|x| x.as_ref())
                     .unwrap_or("\"\""),
             )
+            .arg("--")
             .args(email.envelope.to())
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())

lettre/src/smtp/client/mod.rs

@@ -51,7 +51,15 @@ impl ClientCodec {
                     match self.escape_count {
                         0 => self.escape_count = if *byte == b'\r' { 1 } else { 0 },
                         1 => self.escape_count = if *byte == b'\n' { 2 } else { 0 },
-                        2 => self.escape_count = if *byte == b'.' { 3 } else { 0 },
+                        2 => {
+                            self.escape_count = if *byte == b'.' {
+                                3
+                            } else if *byte == b'\r' {
+                                1
+                            } else {
+                                0
+                            }
+                        }
                         _ => unreachable!(),
                     }
                     if self.escape_count == 3 {
@@ -286,6 +294,7 @@ mod test {
         let mut buf: Vec<u8> = vec![];
 
         assert!(codec.encode(b"test\r\n", &mut buf).is_ok());
+        assert!(codec.encode(b"test\r\n\r\n", &mut buf).is_ok());
         assert!(codec.encode(b".\r\n", &mut buf).is_ok());
         assert!(codec.encode(b"\r\ntest", &mut buf).is_ok());
         assert!(codec.encode(b"te\r\n.\r\nst", &mut buf).is_ok());
@@ -296,7 +305,7 @@ mod test {
         assert!(codec.encode(b"test", &mut buf).is_ok());
         assert_eq!(
             String::from_utf8(buf).unwrap(),
-            "test\r\n..\r\n\r\ntestte\r\n..\r\nsttesttest.test\n.test\ntest"
+            "test\r\ntest\r\n\r\n..\r\n\r\ntestte\r\n..\r\nsttesttest.test\n.test\ntest"
         );
     }
 

lettre_email/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 
 name = "lettre_email"
-version = "0.9.3" # remember to update html_root_url
+version = "0.9.4" # remember to update html_root_url
 description = "Email builder"
 readme = "README.md"
 homepage = "http://lettre.at"
@@ -23,7 +23,7 @@ lettre = { version = "^0.9", path = "../lettre", features = ["smtp-transport"] }
 glob = "0.3"
 
 [dependencies]
-email = "^0.0.21"
+email = "^0.0.20"
 mime = "^0.3"
 time = "^0.1"
 uuid = { version = "^0.7", features = ["v4"] }

lettre_email/src/lib.rs

@@ -1,7 +1,7 @@
 //! Lettre is a mailer written in Rust. lettre_email provides a simple email builder.
 //!
 
-#![doc(html_root_url = "https://docs.rs/lettre_email/0.9.3")]
+#![doc(html_root_url = "https://docs.rs/lettre_email/0.9.4")]
 #![deny(
     missing_docs,
     missing_debug_implementations,
@@ -271,7 +271,13 @@ impl EmailBuilder {
         filename: &str,
         content_type: &Mime,
     ) -> Result<EmailBuilder, Error> {
-        let encoded_body = base64::encode(&body);
+        let encoded_body = base64::encode(&body)
+            .as_bytes()
+            .chunks(72)
+            // base64 encoding is guaranteed to return utf-8, so this won't panic
+            .map(|s| std::str::from_utf8(s).unwrap())
+            .collect::<Vec<_>>()
+            .join("\r\n");
         let content = PartBuilder::new()
             .body(encoded_body)
             .header((