Repository navigation
fix(routes): harden POST /me/inbox/send - #54
Merged
TheGreatAxios merged 1 commit intoSep 27, 2026
Conversation
TheGreatAxios
force-pushed
the
cl-9436-mailbox-harden-the-send-route-recipient-injection-display
branch
from
September 27, 2026 01:23
c6a3155 to
6484cf8
Compare
A recipient carrying CR, LF or NUL is a 400 before anything is appended or handed to deliver, so a header-injection payload never reaches the envelope cache or the host transport. The Message-ID is minted from the addr-spec of the sender (@intx/mime extractAddrSpec), so a senderAddressFor that returns "Name <addr>" no longer 500s, and a sender with no addr-spec falls back to hub.invalid. A RangeError from building the frame, including the frame-byte cap the route now enforces with assertMailboxFrameBytes, is a 400.
TheGreatAxios
force-pushed
the
cl-9436-mailbox-harden-the-send-route-recipient-injection-display
branch
from
September 27, 2026 01:39
6484cf8 to
4f348d0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /me/inbox/sendreturns 400 when a recipient contains CR, LF or NUL. The check runs before the Sent append anddeliver, so a header-injection payload never reaches the envelope cache or the host transport.generateMailboxMessageIdmints from the sender's addr-spec (@intx/mimeextractAddrSpec), so the send route andwriteMailboxMessageboth get<uuid@domain>(persist keeps the inbound message's own Message-ID), and asenderAddressForthat returns"Name <addr>"no longer 500s. A sender with no parseable addr-spec (a bare name, or a trailing comment likep@t.example (c)) falls back to thehub.invaliddomain.assertMailboxFrameBytes. ARangeErrorfrom building the frame or from the cap is a 400.Verification
e2e/mount-send.test.ts: CR/LF/NUL recipients are 400 with no Sent row and no delivery; a display-name sender gets<uuid@t1.example>; a barePatsender gets<uuid@hub.invalid>; a body at the frame cap is 400 with no Sent row and no delivery. All but thehub.invalidcase fail on fix(store): allocate uids in Postgres and enforce uid and Message-ID uniqueness #53.src/frame.test.ts:<p@t.example>mints<uuid@t.example>;p@t.example (c)mints a well-formed id with no comment in it.bun run check, build,test:e2eand the pack smoke pass locally.Closes CL-9436