Skip to content

Commit

Permalink
imapserver: forbid unknown commands before authentication
Browse files Browse the repository at this point in the history
  • Loading branch information
emersion committed Apr 16, 2023
1 parent e52d37f commit b1d929c
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions imapserver/conn.go
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,13 @@ func (c *Conn) readCommand(dec *imapwire.Decoder) error {
case "SEARCH", "UID SEARCH":
err = c.handleSearch(tag, dec, numKind)
default:
if c.state == imap.ConnStateNotAuthenticated {
// Don't allow a single unknown command before authentication to
// mitigate cross-protocol attacks:
// https://www-archive.mozilla.org/projects/netlib/portbanning
c.state = imap.ConnStateLogout
defer c.Bye("Unknown command")
}
err = &imap.Error{
Type: imap.StatusResponseTypeBad,
Text: "Unknown command",
Expand Down

0 comments on commit b1d929c

Please sign in to comment.