aioSMTPD accepts invalid MAIL FROM syntax without angle brackets instead of rejecting with 501
- 主要言語
- Python
- スター
- 373
- フォーク
- 105
- 平均マージ
- 4分
- マージ済み PR(30日)
- 2
説明
### Description
aioSMTPD 1.4.6 accepts a syntactically invalid MAIL FROM command without angle brackets and responds with 250 OK, instead of rejecting it with a 501 response and remaining in the same state as required by RFC 5321 section 4.1.4.
### Affected Version
aioSMTPD server (version 1.4.6)
### Steps to Reproduce
1. Start the aioSMTPD server (listening on 127.0.0.1:8034).
2. Connect via telnet or nc: telnet 127.0.0.1 8034 (or nc 127.0.0.1 8034).
3. Send the following commands:
- EHLO example.com
- MAIL FROM:alice@example.com
4. Observe the server’s reply to the MAIL command.
### Buggy Behavior
The server replies 250 OK to MAIL FROM:alice@example.com (missing angle brackets around the reverse-path), thereby accepting the transaction start when the argument is syntactically invalid.
### Expected Behavior
The server should reject the invalid MAIL FROM with a 501 failure reply and remain in the same state (i.e., not begin a new transaction).
As per RFC 5321: [4.1.4] If the transaction beginning command argument is not acceptable, a 501 failure reply MUST be returned and the SMTP server MUST stay in the same state.
コントリビューションガイド
評価
この issue はまだ評価されていません。