Email/set, Email/copy and Email/import took any string up to 128
characters as a keyword, spaces, parentheses and line breaks included,
and IMAP wrote keywords into FETCH FLAGS byte for byte. A signed-in
user could store a keyword such as "x)\r\n* 1 EXPUNGE" and forge
untagged responses in the IMAP session of everyone who reads the
message, other users of a shared mailbox included. A keyword stored
from an IMAP literal or a Sieve addflag action did the same.
JMAP now refuses, with invalidProperties, a keyword that is not 1 to
255 printable ASCII characters without ( ) { ] % * " \ (RFC 8621
section 4.1.1). IMAP leaves out of FLAGS any stored keyword that is not
an atom, so keywords already stored can't inject either.
Test: on main, a keyword stored from a literal came back as
"* 1 FETCH (FLAGS (... x)" followed by a separate "* 99 EXPUNGE) ..."
line, and Email/set accepted "x)\r\n* 1 EXPUNGE"; both are refused or
left out now, and a unit test covers the name rules.
jcoffey-dev
b4e035a45d