Skip to content

fix: require MIME boundaries to start at line boundaries - #159

Open
audi0417 wants to merge 1 commit into
stalwartlabs:mainfrom
audi0417:fix/mime-boundary-line-start
Open

audi0417 wants to merge 1 commit into
stalwartlabs:mainfrom
audi0417:fix/mime-boundary-line-start

Conversation

@audi0417

Copy link
Copy Markdown

The MIME boundary scanners treat any --<boundary> sequence as a delimiter, even when it appears in the middle of a line or is only a prefix of a longer token. This can silently truncate a MIME part without setting is_encoding_problem.

For example, with boundary BND:

visit --BND for details
SECRET

was parsed as:

visit 

The same issue affects the Base64 and quoted-printable MIME decoders, which use the same boundary matching pattern.

Fix

Require MIME boundaries to start at the beginning of a line and validate the bytes following the boundary name. Valid line endings, optional transport padding, and closing boundary markers are accepted; boundary prefixes and body text are left untouched.

Apply the check consistently to multipart parsing, Base64 decoding, quoted-printable decoding, and malformed-message recovery.

Add regression coverage for mid-line boundary-like text, boundary prefixes, valid closing boundaries, and the existing malformed multipart fixtures.

Closes #156

Testing

  • cargo test
  • cargo clippy --all-targets --all-features -- -D warnings
  • git diff --check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MIME boundary matched mid-line, silently truncating multipart body parts

1 participant