What's Changed
- Security: Reject control characters (the C0 range 0x00-0x1F and DEL 0x7F, including CR, LF, and NUL) in SMTP command arguments, preventing command injection via input passed to mail(), rcpt(), vrfy(), expn() or sendmail(). Such input now raises ValueError before anything is written to the connection. More details: GHSA-v3q9-hj7j-63hq Thanks to @tonghuaroot for the report.
- Bugfix: SMTP.quit() no longer hangs until the read timeout when the peer drops the transport with an exception after QUIT is sent but before the 221 reply is parsed (e.g. AWS SES closing TLS without close_notify). Contributed by @yamaaaaaa31
New Contributors
- @yamaaaaaa31 made their first contribution in #346
Full Changelog: v5.1.0...v5.1.1