jhickner/smtp-mail

Dangerous missing error handling in auth code

Opened this issue · 0 comments

My mail server accepts AUTH only after STARTSSL and replies with 530 5.7.0 Must issue a STARTTLS command first otherwise. But this error message is ignored in sendCommand, which leads to the library happily continue sending the username and password over the wire in plaintext, which will be interpreted as commands, leading to: 502 5.5.2 Error: command not recognized.