Prepare 0.9.6 (#630)

Co-authored-by: Paolo Barbolini <paolo@paolo565.org>

CHANGELOG.md

@@ -1,3 +1,11 @@
+<a name="v0.9.6"></a>
+### v0.9.6 (2021-05-22)
+
+#### Bug Fixes
+
+* **transport**
+  * **SECURITY**: Prevent SMTP command injection in smtp transport
+
 <a name="v0.9.5"></a>
 ### v0.9.5 (2020-11-11)
 

lettre/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 
 name = "lettre"
-version = "0.9.5" # remember to update html_root_url
+version = "0.9.6" # remember to update html_root_url
 description = "Email client"
 readme = "README.md"
 homepage = "http://lettre.at"

lettre/src/lib.rs

@@ -3,7 +3,7 @@
 //! This mailer contains the available transports for your emails.
 //!
 
-#![doc(html_root_url = "https://docs.rs/lettre/0.9.5")]
+#![doc(html_root_url = "https://docs.rs/lettre/0.9.6")]
 #![deny(
     missing_copy_implementations,
     trivial_casts,

lettre/src/smtp/client/mod.rs

@@ -51,7 +51,15 @@ impl ClientCodec {
                     match self.escape_count {
                         0 => self.escape_count = if *byte == b'\r' { 1 } else { 0 },
                         1 => self.escape_count = if *byte == b'\n' { 2 } else { 0 },
-                        2 => self.escape_count = if *byte == b'.' { 3 } else { 0 },
+                        2 => {
+                            self.escape_count = if *byte == b'.' {
+                                3
+                            } else if *byte == b'\r' {
+                                1
+                            } else {
+                                0
+                            }
+                        }
                         _ => unreachable!(),
                     }
                     if self.escape_count == 3 {
@@ -286,6 +294,7 @@ mod test {
         let mut buf: Vec<u8> = vec![];
 
         assert!(codec.encode(b"test\r\n", &mut buf).is_ok());
+        assert!(codec.encode(b"test\r\n\r\n", &mut buf).is_ok());
         assert!(codec.encode(b".\r\n", &mut buf).is_ok());
         assert!(codec.encode(b"\r\ntest", &mut buf).is_ok());
         assert!(codec.encode(b"te\r\n.\r\nst", &mut buf).is_ok());
@@ -296,7 +305,7 @@ mod test {
         assert!(codec.encode(b"test", &mut buf).is_ok());
         assert_eq!(
             String::from_utf8(buf).unwrap(),
-            "test\r\n..\r\n\r\ntestte\r\n..\r\nsttesttest.test\n.test\ntest"
+            "test\r\ntest\r\n\r\n..\r\n\r\ntestte\r\n..\r\nsttesttest.test\n.test\ntest"
         );
     }