1// VULNERABLE, the application constructs the From header as a single
2//             string and passes it to Nodemailer. Nodemailer's structured
3//             API would have rejected newlines, but we never used it.
4import nodemailer from 'nodemailer';
5
6const transport = nodemailer.createTransport({ /* SES / SMTP config */ });
7
8export async function sendContactMessage(req, res) {
9  const { name, email, subject, message } = req.body;
10
11  await transport.sendMail({
12    // BAD, attacker-controlled name and email concatenated into one header string.
13    from: `"${name}" <${email}>`,
14    to: 'support@app.tld',
15    subject: subject,            // BAD, subject reaches header unchecked
16    text: message,
17  });
18
19  res.json({ ok: true });
20}
21
22// An attacker submitting name = "Alice\r\nBcc: victim@bank.com" produces
23// a From line whose newline becomes a header separator. The smuggled Bcc
24// is delivered as part of the same envelope.

1# Classic Bcc smuggling, the original 2002 attack, still works today.
2attacker@x.tld\r\nBcc: victim@bank.com\r\nSubject: Refund pending
3
4# MIME envelope break, replaces the entire message body.
5Alice\r\nContent-Type: text/html\r\n\r\n<a href="https://evil.tld">Click</a>
6
7# URL-encoded form for query-string mailers (?to=, ?subject=).
8to=user@app.tld%0d%0aBcc:victim@bank.com&subject=Update

1// lib/mail-safe.ts, one canonical helper used at every mail sink.
2//
3// Strategy: reject any control byte that could terminate a header line.
4// The structured mailer API does most of the work; this validator is the
5// belt-and-braces layer for legacy code and custom X-* headers.
6
7const CONTROL_BYTES = /[\r\n\0]/;
8
9/** Throws if the value cannot safely become a header value. */
10export function assertHeaderSafe(value: string, field: string): void {
11  if (typeof value !== 'string') {
12    throw new Error(`${field}: must be a string`);
13  }
14  if (CONTROL_BYTES.test(value)) {
15    throw new Error(`${field}: contains forbidden control characters`);
16  }
17  if (value.length > 998) {
18    // RFC 5322 line length cap, defensive against folding-based smuggling.
19    throw new Error(`${field}: exceeds 998 characters`);
20  }
21}
22
23/** Returns a validated, ready-to-use header value. */
24export function headerSafe(value: unknown, field: string): string {
25  const s = value == null ? '' : String(value);
26  assertHeaderSafe(s, field);
27  return s;
28}
29
30// Use the helper at EVERY mail sink. Do not pass raw values through.
31import nodemailer from 'nodemailer';
32
33await transport.sendMail({
34  from: { name: headerSafe(name, 'name'), address: 'noreply@app.tld' },
35  replyTo: headerSafe(email, 'email'),
36  to: 'support@app.tld',
37  subject: headerSafe(subject, 'subject'),
38  text: message, // body is fine; CRLF is legal here
39});

1# lib/mail_safe.py, the structured API is the primary control;
2# the validator is the second layer for any remaining raw-header path.
3import re
4from email.message import EmailMessage
5from email_validator import validate_email, EmailNotValidError
6
7_CONTROL = re.compile(r"[\r\n\x00]")
8
9def assert_header_safe(value: str, field: str) -> None:
10    if not isinstance(value, str):
11        raise ValueError(f"{field}: must be a string")
12    if _CONTROL.search(value):
13        raise ValueError(f"{field}: contains forbidden control characters")
14    if len(value) > 998:
15        raise ValueError(f"{field}: exceeds 998 characters")
16
17def safe_address(addr: str) -> str:
18    # Raises on invalid syntax, IDN domains are normalised.
19    return validate_email(addr, check_deliverability=False).normalized
20
21def build_contact_message(name: str, email: str, subject: str, body: str) -> EmailMessage:
22    assert_header_safe(name, "name")
23    assert_header_safe(subject, "subject")
24    email = safe_address(email)
25
26    msg = EmailMessage()
27    # Structured calls; the library refuses to embed CRLF.
28    msg["From"] = ("noreply@app.tld",)
29    msg["Reply-To"] = email
30    msg["To"] = "support@app.tld"
31    msg["Subject"] = subject
32    msg.set_content(body)
33    # The display name reaches headers via a structured 2-tuple,
34    # not by concatenating "Name <addr>" by hand.
35    msg.replace_header("Reply-To", f"{name} <{email}>")
36    return msg

1<?php
2// Use PHPMailer&apos;s structured API. Never call mail() with concatenated
3// headers; do not pass attacker-controlled strings to the $headers arg.
4use PHPMailer\PHPMailer\PHPMailer;
5use PHPMailer\PHPMailer\Exception;
6
7function assert_header_safe(string $value, string $field): void {
8    if (preg_match('/[\r\n\x00]/', $value) === 1) {
9        throw new InvalidArgumentException("$field contains control bytes");
10    }
11    if (strlen($value) > 998) {
12        throw new InvalidArgumentException("$field exceeds 998 characters");
13    }
14}
15
16function send_contact(string $name, string $email, string $subject, string $body): void {
17    assert_header_safe($name, 'name');
18    assert_header_safe($subject, 'subject');
19    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
20        throw new InvalidArgumentException('email is not a valid address');
21    }
22
23    $mail = new PHPMailer(true);
24    $mail->setFrom('noreply@app.tld');       // fixed From, not user-controlled
25    $mail->addReplyTo($email, $name);        // structured, library refuses CRLF
26    $mail->addAddress('support@app.tld');
27    $mail->Subject = $subject;               // structured, library validates
28    $mail->Body = $body;
29    $mail->send();
30}
31// Reminder: CVE-2016-10033 (PHPMailer) was a header-injection-class bug
32// in the From parameter. Keep the library patched and avoid the legacy
33// mail() function entirely.

1import jakarta.mail.*;
2import jakarta.mail.internet.*;
3
4public final class MailSafe {
5    private static final java.util.regex.Pattern CONTROL =
6        java.util.regex.Pattern.compile("[\\r\\n\\x00]");
7
8    public static String headerSafe(String value, String field) {
9        if (value == null) return "";
10        if (CONTROL.matcher(value).find()) {
11            throw new IllegalArgumentException(field + " contains control bytes");
12        }
13        if (value.length() > 998) {
14            throw new IllegalArgumentException(field + " exceeds 998 characters");
15        }
16        return value;
17    }
18
19    public static void sendContact(Session session, String name,
20                                   String email, String subject, String body)
21            throws MessagingException {
22        // Strict parsing: throws on syntactically invalid addresses,
23        // including ones with embedded CRLF inside a quoted local-part.
24        InternetAddress reply = new InternetAddress(email, true);
25        reply.setPersonal(headerSafe(name, "name"));
26
27        MimeMessage msg = new MimeMessage(session);
28        msg.setFrom(new InternetAddress("noreply@app.tld"));
29        msg.setReplyTo(new Address[] { reply });
30        msg.setRecipient(Message.RecipientType.TO,
31                         new InternetAddress("support@app.tld"));
32        msg.setSubject(headerSafe(subject, "subject"));
33        msg.setText(body);
34        Transport.send(msg);
35    }
36}