a

internal/webclient/compose.go

@@ -62,10 +62,10 @@ func BuildRFC5322(p *ComposeParams) ([]byte, error) {
 	writeHeader("Message-Id", p.MessageID)
 	writeHeader("MIME-Version", "1.0")
 	if p.InReplyTo != "" {
-		writeHeader("In-Reply-To", p.InReplyTo)
+		writeHeader("In-Reply-To", sanitizeHeaderValue(p.InReplyTo))
 	}
 	if p.References != "" {
-		writeHeader("References", p.References)
+		writeHeader("References", sanitizeHeaderValue(p.References))
 	}
 
 	// Write body as quoted-printable text/plain.
@@ -191,3 +191,13 @@ func (s *Server) enqueueForDelivery(ctx context.Context, fromEmail, toEmail stri
 	_, err = s.deps.DB.EnqueueMessage(ctx, domID, fromEmail, toEmail, msgID, rawEnc, maxAge)
 	return err
 }
+
+// sanitizeHeaderValue strips CR and LF from a header value to prevent injection.
+func sanitizeHeaderValue(s string) string {
+	return strings.Map(func(r rune) rune {
+		if r == '\r' || r == '\n' {
+			return -1
+		}
+		return r
+	}, s)
+}