Skip to content

Conversation

zdAlexM
Copy link

@zdAlexM zdAlexM commented Mar 28, 2023

Hi,

I've found an issue with the rcptto_list method in Net::SMTP. It attempts to protect against "unknown users", but only tests against 53x-class errors, which are authentication-related. Additionally, in the case of some acceptable recipients, but others returning 53x-class errors, the block would be yielded to before the exception is thrown, potentially sending messages to the accepted recipients.

This patch updates this library to be more robust against mixed SMTP statuses.

  • A new exception, SMTPMailboxPermanentlyUnavailable, can be thrown from any method that accepts a recipient address. It is a subclass of SMTPFatalError.
  • A new exception, SMTPMixedRecipientStatus, can be thrown from rcptto_list. It is a subclass of SMTPMailboxPermanentlyUnavailable.
  • In the event of all recipients being rejected by the server, previous versions of this gem would raise an ArgumentError that was indistinguishable from providing 0 recipient addresses. Now it will raise a more specific SMTP error.
  • These exceptions are thrown before the method yields to the block. This allows the caller to inspect the exception and determine whether or not to continue with the transaction, instead.

zdAlexM added 25 commits March 24, 2023 13:08
This change comes with some behavior changes:

* A new exception, SMTPMailboxPermanentlyUnavailable, can be thrown
  from any method that accepts a recipient address. It is a subclass
  of SMTPFatalError.
* A new exception, SMTPMixedRecipientStatus, can be thrown from
  `rcptto_list`. It is a subclass of SMTPMailboxPermanentlyUnavailable.
* In the event of all recipients being rejected by the server,
  previous versions of this gem would raise an `ArgumentError` that
  was indistinguishable from providing 0 recipient addresses. Now it
  will raise a more specific SMTP error.
* These exceptions are thrown *before* the method yields to the block.
  This allows the caller to inspect the exception and determine
  whether or not to continue with the transaction, instead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant