CodeQL flagged critical vulnerabilities in mail_service.go where
untrusted input could be used to inject additional email headers
via CRLF sequences.
Changes:
- Add sanitizeEmailHeader() to strip CR, LF, and control characters
- Sanitize all header values (from, to, subject) in buildEmail()
- Add validateEmailAddress() using net/mail.ParseAddress
- Add comprehensive security tests for header injection prevention
This addresses the 3 critical CodeQL alerts:
- Line 199: buildEmail header construction
- Line 260: sendSSL message usage
- Line 307: sendSTARTTLS message usage
Security: CWE-93 (Improper Neutralization of CRLF Sequences)
- Added a new SMTP settings page with functionality to configure SMTP settings, test connections, and send test emails.
- Implemented user management page to list users, invite new users, and manage user permissions.
- Created modals for inviting users and editing user permissions.
- Added tests for the new SMTP settings and user management functionalities.
- Updated navigation to include links to the new SMTP settings and user management pages.
