bpo-43124: Fix smtplib multiple CRLF injection (GH-25987)

Co-authored-by: Łukasz Langa <lukasz@langa.pl>

1 files changed, 8 insertions, 3 deletions

diff --git a/Lib/smtplib.py b/Lib/smtplib.py
index 7e984e8..324a1c1 100755
--- a/Lib/smtplib.py
+++ b/Lib/smtplib.py
@@ -367,10 +367,15 @@ class SMTP:
     def putcmd(self, cmd, args=""):
         """Send a command to the server."""
         if args == "":
-            str = '%s%s' % (cmd, CRLF)
+            s = cmd
         else:
-            str = '%s %s%s' % (cmd, args, CRLF)
-        self.send(str)
+            s = f'{cmd} {args}'
+        if '\r' in s or '\n' in s:
+            s = s.replace('\n', '\\n').replace('\r', '\\r')
+            raise ValueError(
+                f'command and arguments contain prohibited newline characters: {s}'
+            )
+        self.send(f'{s}{CRLF}')
 
     def getreply(self):
         """Get a reply from the server.