Prepare 0.9.5 release

Fix attachment line length

CHANGELOG.md

@@ -1,3 +1,11 @@
+<a name="v0.9.5"></a>
+### v0.9.5 (2020-11-11)
+
+#### Bug Fixes
+
+* **transport**
+  * **SECURITY**: Prevent argument injection in sendmail transport
+
 <a name="v0.9.4"></a>
 ### v0.9.4 (2020-04-21)
 

lettre/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 
 name = "lettre"
-version = "0.9.3" # remember to update html_root_url
+version = "0.9.5" # remember to update html_root_url
 description = "Email client"
 readme = "README.md"
 homepage = "http://lettre.at"

lettre/src/lib.rs

@@ -3,7 +3,7 @@
 //! This mailer contains the available transports for your emails.
 //!
 
-#![doc(html_root_url = "https://docs.rs/lettre/0.9.3")]
+#![doc(html_root_url = "https://docs.rs/lettre/0.9.5")]
 #![deny(
     missing_copy_implementations,
     trivial_casts,

lettre/src/sendmail/mod.rs

@@ -50,6 +50,7 @@ impl<'a> Transport<'a> for SendmailTransport {
                     .map(|x| x.as_ref())
                     .unwrap_or("\"\""),
             )
+            .arg("--")
             .args(email.envelope.to())
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())

lettre_email/src/lib.rs

@@ -271,7 +271,13 @@ impl EmailBuilder {
         filename: &str,
         content_type: &Mime,
     ) -> Result<EmailBuilder, Error> {
-        let encoded_body = base64::encode(&body);
+        let encoded_body = base64::encode(&body)
+            .as_bytes()
+            .chunks(72)
+            // base64 encoding is guaranteed to return utf-8, so this won't panic
+            .map(|s| std::str::from_utf8(s).unwrap())
+            .collect::<Vec<_>>()
+            .join("\r\n");
         let content = PartBuilder::new()
             .body(encoded_body)
             .header((