Merge tag '0.3.3'

Upyo 0.3.3

Author: dahlia

CHANGES.md

@@ -7,6 +7,19 @@ Version 0.4.0
 To be released.
 
 
+Version 0.3.3
+-------------
+
+Released on December 13, 2025.
+
+### @upyo/core
+
+ -  Fixed a potential SMTP command injection vulnerability.
+
+    Email addresses are now validated to prevent newline characters (`\r` or
+    `\n`), which could be used to inject malicious SMTP commands.
+
+
 Version 0.3.2
 -------------
 
@@ -95,6 +108,19 @@ Released on September 16, 2025.
 [#9]: https://github.com/dahlia/upyo/issues/9
 
 
+Version 0.2.4
+-------------
+
+Released on December 13, 2025.
+
+### @upyo/core
+
+ -  Fixed a potential SMTP command injection vulnerability.
+
+    Email addresses are now validated to prevent newline characters (`\r` or
+    `\n`), which could be used to inject malicious SMTP commands.
+
+
 Version 0.2.3
 -------------
 

packages/core/src/address.test.ts

@@ -291,4 +291,16 @@ test("parseAddress() - boundary and malformed cases", () => {
   assert.ok(invalidIp === undefined || typeof invalidIp === "object");
 });
 
+test("parseAddress() - should not allow newlines", () => {
+  // Test for SMTP command injection vulnerabilities
+  assert.strictEqual(parseAddress("test@example.com\r\nVRFY root"), undefined);
+  assert.strictEqual(parseAddress("test@example.com\nVRFY root"), undefined);
+  assert.strictEqual(parseAddress("test@example.com\rVRFY root"), undefined);
+  assert.strictEqual(
+    parseAddress("sender@example.com>\r\nVRFY root"),
+    undefined,
+  );
+  assert.strictEqual(parseAddress('"test\r\n"@example.com'), undefined);
+});
+
 // cSpell: ignore reparsed punycode

packages/core/src/address.ts

@@ -125,6 +125,11 @@ function isValidEmail(email: string): boolean {
     return false;
   }
 
+  // Prevent SMTP command injection by disallowing newlines
+  if (email.includes("\r") || email.includes("\n")) {
+    return false;
+  }
+
   // Find the @ symbol that separates local and domain parts
   // If the local part is quoted, we need to find the @ after the closing quote
   let atIndex = -1;