Skip to content

auth: Sanitize untrusted input better - #1646

Merged
sirainen merged 2 commits into
dovecot:mainfrom
mbettini-ox:DOV-9206
Oct 20, 2026
Merged

sirainen merged 2 commits into
dovecot:mainfrom
mbettini-ox:DOV-9206

Conversation

@mbettini-ox

Copy link
Copy Markdown
Contributor

No description provided.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@mbettini-ox
mbettini-ox force-pushed the DOV-9206 branch 2 times, most recently from fa12dce to 82d3989 Compare September 22, 2026 08:31
@mbettini-ox
mbettini-ox force-pushed the DOV-9206 branch 2 times, most recently from 893bd0b to 052cbee Compare October 8, 2026 14:17
Comment thread docs/installation/upgrade/include/2.4.6-log-control-chars.inc Outdated
@mbettini-ox
mbettini-ox force-pushed the DOV-9206 branch 4 times, most recently from 2b8b02c to 314fa8c Compare October 13, 2026 10:22
@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

Comment thread docs/installation/upgrade/include/2.4.6-log-control-chars.inc Outdated
@mbettini-ox
mbettini-ox force-pushed the DOV-9206 branch 5 times, most recently from 356745b to afd6a59 Compare October 16, 2026 15:16
Comment thread docs/installation/upgrade/include/2.4.6-login-session-id.inc Outdated
@github-actions

This comment has been minimized.

@mbettini-ox
mbettini-ox force-pushed the DOV-9206 branch 2 times, most recently from dabf8b9 to 5367716 Compare October 19, 2026 13:06
Login passdb:<name> variables replace control characters and invalid
UTF-8 with ? so they cannot inject into log lines or forwarded fields.
Forwarded session IDs are now validated and an invalid one fails the
whole ID/XCLIENT command, so third-party proxies that generate their
own session IDs need to know the accepted format.
@sirainen
sirainen merged commit e72e537 into dovecot:main Oct 20, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants