emersion / emersion/go-smtp

Incorrect handling of the interrupted AUTH command

Open
#191 1 comment 0 reactions 0 assignees View on GitHub
server
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
6d 22h
Merged PRs (30d)
1

Description

Example server logs:

```
...
AUTH PLAIN *masked*
454 4.7.0 auth failed
* -> produces 'Command too short: "*"'
501 5.5.2 Bad command
QUIT
221 2.0.0 Bye
````

Expected behavior:

```
...
AUTH PLAIN *masked*
454 4.7.0 auth failed
*
501 5.0.0 Negotiation cancelled
QUIT
221 2.0.0 Bye
```

See related code:

client: https://github.com/emersion/go-smtp/blob/608f3c2840584931f2867716078c43485ea7ef3f/client.go#L353

server code which is triggered: https://github.com/emersion/go-smtp/blob/608f3c2840584931f2867716078c43485ea7ef3f/parse.go#L18
via https://github.com/emersion/go-smtp/blob/608f3c2840584931f2867716078c43485ea7ef3f/server.go#L175-L181

server code, which expected be triggered: https://github.com/emersion/go-smtp/blob/608f3c2840584931f2867716078c43485ea7ef3f/conn.go#L568-L572

Contributor guide

Open the contributing guide

Research direction

Trace the interrupted AUTH flow from client.go around line 353 through server.go lines 175-181 and parse.go line 18, then compare it with the expected handling in conn.go lines 568-572. Reproduce the logged exchange and verify that a cancelled AUTH negotiation returns the expected 501 response instead of treating the input as a normal command.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.