Repository navigation
fix(smtp): strip a folded Bcc header from the outgoing DATA - #294
Merged
robert-virkus merged 1 commit intoSep 29, 2026
Merged
Conversation
SmtpSendMailCommand and SmtpSendMailDataCommand removed the Bcc header with `^Bcc:.*\r\n`, which only matches the first physical line. Header.render folds any value longer than MailConventions.textLineMaxLength onto `\r\n\t`-prefixed continuation lines, which three or four addresses already do, so everything after the first line stayed in the DATA and every To/Cc recipient received the rest of the Bcc list. The pattern now consumes the continuation lines as well. The envelope was never affected: recipientAddresses already includes bcc.
Member
|
Good find, thanks again, David! |
marcov-dart
pushed a commit
to marcov-dart/enough_mail
that referenced
this pull request
Oct 6, 2026
…er section The folded-Bcc fix from Enough-Software#294 only covered the DATA command; the BDAT command, which MailClient prefers whenever a server announces CHUNKING, still matched a single physical line and leaked every folded Bcc recipient to all other recipients. Both paths now share removeBccHeader, which matches the header name case-insensitively and never touches the body, so a body line starting with 'Bcc:' is no longer removed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SmtpSendMailCommandandSmtpSendMailDataCommandremove the Bcc header from the DATA with^Bcc:.*\r\n, which matches only the first physical line.Header.renderfolds any value longer thanMailConventions.textLineMaxLengthonto\r\n\t-prefixed continuation lines, and three or four display-named addresses are enough to cross that. Everything after the first line therefore stayed in the message, so every To/Cc recipient received the rest of the Bcc list.This makes the pattern consume the continuation lines too:
The envelope was never affected:
recipientAddressesalready includes bcc, so Bcc recipients were delivered to. Only the header leaked.Test: builds a message whose Bcc header folds, and checks the command's DATA has no Bcc line, no continuation line and none of the hidden addresses, while To, Cc, Subject and body survive.