Skip to content

Replace Q_ENUMS with individual Q_ENUM#186

Merged
bluetiger9 merged 5 commits into
bluetiger9:v2.0from
Edward-LeBlanc:Issue_185_smtp-crlf-sanitization
Jul 14, 2025
Merged

Replace Q_ENUMS with individual Q_ENUM#186
bluetiger9 merged 5 commits into
bluetiger9:v2.0from
Edward-LeBlanc:Issue_185_smtp-crlf-sanitization

Conversation

@Edward-LeBlanc
Copy link
Copy Markdown
Contributor

Added sanitizing header fields (remove \r, \n) preventing malicious injection.

Added replacing naked LFs and CRs with CRLF to be compliant with SMTP standard (RFC 5321).

In SmtpClient.h, replace Q_ENUMS with individual Q_ENUM so that debugging prints names instead of numerical values, added string() function for enum types.

Tested with strict SMTP server.

…njection.

Added replacing naked LFs and CRs with CRLF to be compliant with SMTP standard (RFC 5321).
In SmtpClient.h, replace Q_ENUMS with individual Q_ENUM, added string() function for enum types.
MAde QRegularExpressions static.
@bluetiger9
Copy link
Copy Markdown
Owner

Hi @Edward-LeBlanc! 🙂

I would say sanitizing user input should be done in the application code, not by the library.

Content wise MIME allows sending basically anything. You just need to change the default 8Bit content encoding to something that handles special characters / newlines, etc, for ex. Base64:

part.setEncoding(MimePart::Encoding::Base64)

For headers you can use QuotedPrintable / Base64 encoding:

message.setHeaderEncoding(MimePart::Encoding::QuotedPrintable); // or ::Base64

Thx!

@Edward-LeBlanc
Copy link
Copy Markdown
Contributor Author

Edward-LeBlanc commented Jul 12, 2025

I was trying to not repeat code, but I respect your decision. I had already changed the encoding to Base64 in my project, but I apparently missed a couple places that are now fixed. That, of course, is the problem with duplicated code in legacy projects.

What do you think about the part in SmtpClient.h: "replace Q_ENUMS with individual Q_ENUM, added string() function for enum types”? The result of this is seeing the enum names instead of the numeric values in debug and log messages. If you are OK with that, I would revert the other changes.

@bluetiger9
Copy link
Copy Markdown
Owner

The enum change can remain, it makes perfect sense. Thx!

@bluetiger9 bluetiger9 merged commit d995617 into bluetiger9:v2.0 Jul 14, 2025
1 check passed
@Edward-LeBlanc Edward-LeBlanc changed the title Fix issue 185: Enforce CRLF and sanitize header fields Replace Q_ENUMS with individual Q_ENUM Jul 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants