From d4b690d5d3a7f6a6b57afd7a6177db0db20a9c94 Mon Sep 17 00:00:00 2001 From: Manos Pitsidianakis Date: Mon, 10 Jan 2022 15:51:27 +0200 Subject: [PATCH] melib/imap: send password as byte literal on LOGIN Concerns #125 Escape IMAP passwords properly https://git.meli.delivery/meli/meli/issues/125 --- melib/src/backends/imap/connection.rs | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/melib/src/backends/imap/connection.rs b/melib/src/backends/imap/connection.rs index 75f6a855..4acb161d 100644 --- a/melib/src/backends/imap/connection.rs +++ b/melib/src/backends/imap/connection.rs @@ -376,23 +376,22 @@ impl ImapStream { _ => { ret.send_command( format!( - r#"LOGIN "{}" "{}""#, + r#"LOGIN "{}" {{{}}}"#, &server_conf .server_username .replace(r#"\"#, r#"\\"#) .replace('"', r#"\""#) .replace('{', r#"\{"#) .replace('}', r#"\}"#), - &server_conf - .server_password - .replace(r#"\"#, r#"\\"#) - .replace('"', r#"\""#) - .replace('{', r#"\{"#) - .replace('}', r#"\}"#) + &server_conf.server_password.as_bytes().len() ) .as_bytes(), ) .await?; + // wait for "+ Ready for literal data" reply + ret.wait_for_continuation_request().await?; + ret.send_literal(server_conf.server_password.as_bytes()) + .await?; } } let tag_start = format!("M{} ", (ret.cmd_id - 1));