feat: per-message extra headers in the mail envelope

2026-09-11 13:33:12 +00:00
parent 91d10a7650
commit a901482e5d
2 changed files with 41 additions and 0 deletions
@@ -83,3 +83,30 @@ func TestEnvelopePartsAreQuotedPrintable(t *testing.T) {
 		}
 	}
 }
+
+func TestEnvelopeWritesExtraHeadersSanitised(t *testing.T) {
+	s := Sender{From: "Vantage <updates@example.com>"}
+	raw, err := s.envelope(message{
+		To: "a@example.com", Subject: "s", Text: "t", HTML: "<p>h</p>",
+		Headers: map[string]string{
+			"List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
+			"List-Unsubscribe":      "<https://x.example/u?t=1>\r\nBcc: evil@example.com",
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	msg, err := mail.ReadMessage(bytes.NewReader(raw))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := msg.Header.Get("List-Unsubscribe-Post"); got != "List-Unsubscribe=One-Click" {
+		t.Fatalf("List-Unsubscribe-Post = %q", got)
+	}
+	if got := msg.Header.Get("Bcc"); got != "" {
+		t.Fatalf("header injection: Bcc = %q", got)
+	}
+	if !strings.HasPrefix(msg.Header.Get("List-Unsubscribe"), "<https://x.example/u?t=1>") {
+		t.Fatalf("List-Unsubscribe = %q", msg.Header.Get("List-Unsubscribe"))
+	}
+}