MailingKit

Reference

Security

Email is an old protocol with sharp edges. MailingKit's defaults are chosen so the safe path is the one you get without thinking about it.

Header injection

A line break in a header value lets an attacker add their own headers, such as a hidden Bcc. MailingKit rejects carriage returns, line feeds and null bytes in subjects, display names, addresses and custom header values, and collapses whitespace in rendered subjects so template data cannot inject one either. Headers that MailingKit builds itself (From, To, Cc, Bcc, Subject, Content-Type and others) cannot be overridden through headers=.

Untrusted content in templates

  • Values are HTML-escaped in .html templates. Mark trusted HTML explicitly with Jinja2's |safe only when you are sure.
  • Templates run in Jinja2's sandbox, which blocks access to internal attributes such as __class__.
  • Templates are only loaded by name from your template folder. Names with .. or absolute paths are refused, and user input is never compiled as a template.

Links from users

Escaping stops markup, not malicious URLs. Build links from values you control (ids, tokens) rather than accepting full URLs from users.

Secrets

Credentials are held in a Secret type whose repr and str are always Secret('**********'). Provider reprs and error messages never include API keys or passwords. Keep credentials in environment variables or your secret manager; MailingKit never needs them in code.

Logs and events

Log lines and hook events contain MailingKit's send id, the provider, the template name, the attempt number and the error type. They never contain recipients, subjects, bodies or template data, so forwarding them to a log platform does not leak personal data.

Transport security

SMTP uses STARTTLS with certificate verification by default. Implicit TLS is available with security="ssl". Plain connections are allowed only for local tools, and MailingKit refuses to send a username and password over them. HTTP providers use HTTPS.

Limits

  • At most 50 recipients per message and about 10 MiB per message by default (Limits).
  • Attachment filenames with path separators, control characters or .. are refused.
  • Addresses are validated before sending, including internationalized domains.

Reporting a vulnerability

Please report security issues privately through GitHub's security advisories rather than a public issue.