Add SMTP injection guards (#77)

* fix(smtp): block injection vectors in envelope addresses and header names

Co-authored-by: null <>

* fix(smtp): sanitize bare CR in header values and block DEL/non-ASCII in envelopes

* fix(smtp): sanitize bare CR in header values and block DEL/non-ASCII in envelopes

---------

Co-authored-by: tembo[bot] <208362400+tembo[bot]@users.noreply.github.com>

Author: tembo[bot]

.changeset/smtp-injection-guard.md

@@ -0,0 +1,5 @@
+---
+"@opencoredev/email-sdk": patch
+---
+
+Reject SMTP envelope addresses and header names that contain control characters, whitespace, or angle brackets before connecting. This closes an SMTP command/header injection vector where a crafted recipient address or header name could smuggle extra SMTP commands or headers into the session.

bun.lock

@@ -26,6 +26,9 @@
     "dotenv": "^17.2.2",
     "zod": "^4.1.13"
   },
+  "overrides": {
+    "ws": "^8.20.1"
+  },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
     "@email-sdk/config": "workspace:*",

package.json

@@ -0,0 +1,134 @@
+import { describe, expect, test } from "bun:test";
+import net from "node:net";
+
+import { EmailValidationError } from "./errors.js";
+import { smtp } from "./smtp.js";
+import type { EmailMessage } from "./types.js";
+
+const baseMessage: EmailMessage = {
+  from: "sender@example.com",
+  to: "recipient@example.com",
+  subject: "Hello",
+  text: "Hi there",
+};
+
+function send(message: EmailMessage) {
+  // host points at an unroutable port; validation must reject before any connect.
+  return smtp({ host: "127.0.0.1", port: 1 }).send(message, { attempt: 1 });
+}
+
+// Runs a minimal in-process SMTP server, sends the message through the adapter,
+// and returns the raw DATA payload the client transmitted.
+async function captureSmtpData(message: EmailMessage) {
+  let captured = "";
+  let inData = false;
+
+  const server = net.createServer((socket) => {
+    socket.setEncoding("utf8");
+    socket.write("220 test.local\r\n");
+    socket.on("data", (chunk: string) => {
+      if (inData) {
+        captured += chunk;
+
+        if (captured.endsWith("\r\n.\r\n")) {
+          inData = false;
+          socket.write("250 queued as test-id\r\n");
+        }
+
+        return;
+      }
+
+      const command = chunk.trim().toUpperCase();
+
+      if (command.startsWith("EHLO")) {
+        socket.write("250 test.local\r\n");
+      } else if (command.startsWith("MAIL") || command.startsWith("RCPT")) {
+        socket.write("250 ok\r\n");
+      } else if (command === "DATA") {
+        inData = true;
+        socket.write("354 go ahead\r\n");
+      } else if (command === "QUIT") {
+        socket.write("221 bye\r\n");
+        socket.end();
+      } else {
+        socket.write("250 ok\r\n");
+      }
+    });
+  });
+
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const { port } = server.address() as net.AddressInfo;
+
+  try {
+    await smtp({ host: "127.0.0.1", port }).send(message, { attempt: 1 });
+  } finally {
+    server.close();
+  }
+
+  return captured;
+}
+
+describe("smtp injection guards", () => {
+  test("rejects CRLF injected into the envelope address", async () => {
+    await expect(
+      send({ ...baseMessage, to: "victim@example.com\r\nRCPT TO:evil@example.com" }),
+    ).rejects.toBeInstanceOf(EmailValidationError);
+  });
+
+  test("rejects whitespace and angle brackets in the envelope address", async () => {
+    await expect(
+      send({ ...baseMessage, from: "attacker@example.com> evil" }),
+    ).rejects.toBeInstanceOf(EmailValidationError);
+  });
+
+  test("rejects a CRLF injected header name", async () => {
+    await expect(
+      send({
+        ...baseMessage,
+        headers: { "X-Trace\r\nBcc: hidden@evil.com": "1" },
+      }),
+    ).rejects.toBeInstanceOf(EmailValidationError);
+  });
+
+  test("rejects a colon in a header name", async () => {
+    await expect(
+      send({ ...baseMessage, headers: [{ name: "X-Bad: Injected", value: "1" }] }),
+    ).rejects.toBeInstanceOf(EmailValidationError);
+  });
+
+  test("rejects DEL and non-ASCII characters in the envelope address", async () => {
+    await expect(send({ ...baseMessage, to: "victim\x7f@example.com" })).rejects.toBeInstanceOf(
+      EmailValidationError,
+    );
+    await expect(send({ ...baseMessage, to: "víctim@example.com" })).rejects.toBeInstanceOf(
+      EmailValidationError,
+    );
+  });
+
+  test("bare CR in a header value is folded before transmission", async () => {
+    const transmitted = await captureSmtpData({
+      ...baseMessage,
+      headers: { "X-Custom": "legit\rBcc: evil@example.com" },
+    });
+
+    // The lone \r is folded into a space, so the value stays on one header line
+    // and no injected Bcc header reaches the wire.
+    expect(transmitted).toContain("X-Custom: legit Bcc: evil@example.com");
+    const injected = transmitted
+      .split(/\r\n|[\r\n]/)
+      .some((line) => line.toLowerCase().startsWith("bcc:"));
+    expect(injected).toBe(false);
+  });
+
+  test("accepts addresses with hyphens and plus signs", async () => {
+    // A valid message should pass validation and fail later at the network layer,
+    // never with a validation error.
+    await expect(
+      send({
+        ...baseMessage,
+        from: "no-reply+tag@my-domain.example.com",
+        to: "user.name+tag@sub-domain.example.com",
+      }),
+    ).rejects.not.toBeInstanceOf(EmailValidationError);
+  });
+});

packages/email-sdk/src/smtp.test.ts

@@ -2,13 +2,14 @@ import { randomUUID } from "node:crypto";
 import net from "node:net";
 import tls from "node:tls";
 
-import { EmailProviderError } from "./errors.js";
+import { EmailProviderError, EmailValidationError } from "./errors.js";
 import type { EmailAddress, EmailMessage, EmailProvider } from "./types.js";
 import {
   SUPPORTED_MESSAGE_FIELDS,
   assertSupportedMessageFields,
   formatAddress,
   formatAddresses,
+  headersToArray,
   headersToObject,
 } from "./utils.js";
 
@@ -46,6 +47,7 @@ export function smtp(options: SmtpProviderOptions): EmailProvider<{ host: string
     },
     async send(message) {
       assertSupportedMessageFields(name, message, SUPPORTED_MESSAGE_FIELDS.smtp);
+      assertSmtpMessage(message);
       const client = new SmtpClient(options, port);
 
       try {
@@ -310,6 +312,46 @@ function buildMimeMessage(message: EmailMessage, defaults: SmtpProviderOptions["
   return `${headerText}\r\nContent-Type: ${contentType}; charset=utf-8\r\n\r\n${body}`;
 }
 
+// Envelope addresses are interpolated into MAIL FROM/RCPT TO commands. RFC 5321
+// envelopes only allow printable US-ASCII, so reject whitespace (including
+// CR/LF), control characters (including DEL), angle brackets, and non-ASCII
+// characters before connecting.
+// oxlint-disable-next-line no-control-regex -- control characters are the point
+const SMTP_FORBIDDEN_ENVELOPE = /[\x00-\x20<>\x7f-\uffff]/;
+
+// RFC 5322 header field names: printable US-ASCII (0x21-0x7e) excluding the
+// colon (0x3a). A name containing CR/LF would terminate the header and inject more.
+const SMTP_HEADER_NAME = /^[!-9;-~]+$/;
+
+function assertSmtpMessage(message: EmailMessage) {
+  const addresses = [
+    formatAddress(message.from),
+    ...formatAddresses(message.to),
+    ...formatAddresses(message.cc),
+    ...formatAddresses(message.bcc),
+  ];
+
+  for (const address of addresses) {
+    const envelope = parseEmailAddress(address);
+
+    if (envelope.length === 0 || SMTP_FORBIDDEN_ENVELOPE.test(envelope)) {
+      throw new EmailValidationError(
+        `SMTP envelope address ${JSON.stringify(envelope)} contains invalid characters.`,
+        { adapter: "smtp", address: envelope },
+      );
+    }
+  }
+
+  for (const header of headersToArray(message.headers) ?? []) {
+    if (!SMTP_HEADER_NAME.test(header.name)) {
+      throw new EmailValidationError(
+        `SMTP header name ${JSON.stringify(header.name)} contains invalid characters.`,
+        { adapter: "smtp", header: header.name },
+      );
+    }
+  }
+}
+
 function envelopeAddress(address: EmailAddress) {
   return parseEmailAddress(formatAddress(address));
 }
@@ -324,7 +366,7 @@ function escapeData(value: string) {
 }
 
 function foldHeader(value: string) {
-  return value.replace(/\r?\n/g, " ");
+  return value.replace(/\r\n|[\r\n]/g, " ");
 }
 
 function extractSmtpMessageId(response: string) {