Reject CR/LF in POP3 command arguments

lib/net/pop.rb

@@ -984,15 +984,22 @@ def quit
     private
 
     def getok(fmt, *fargs)
-      @socket.writeline sprintf(fmt, *fargs)
+      @socket.writeline validate_line(sprintf(fmt, *fargs))
       check_response(recv_response())
     end
 
     def get_response(fmt, *fargs)
-      @socket.writeline sprintf(fmt, *fargs)
+      @socket.writeline validate_line(sprintf(fmt, *fargs))
       recv_response()
     end
 
+    def validate_line(line)
+      if /[\r\n]/.match?(line)
+        raise ArgumentError, "POP3 command cannot include CR/LF"
+      end
+      line
+    end
+
     def recv_response
       @socket.readline
     end

test/net/pop/test_pop.rb

@@ -64,6 +64,30 @@ def test_apop_invalid_at
     end
   end
 
+  def test_pop_user_crlf_injection
+    pop_test(false) do |pop|
+      assert_raise ArgumentError do
+        pop.start("user\r\nDELE 1", @users[@ok_user])
+      end
+    end
+  end
+
+  def test_pop_pass_crlf_injection
+    pop_test(false) do |pop|
+      assert_raise ArgumentError do
+        pop.start(@ok_user, "pass\r\nDELE 1")
+      end
+    end
+  end
+
+  def test_apop_crlf_injection
+    pop_test(@stamp_base) do |pop|
+      assert_raise ArgumentError do
+        pop.start("user\r\nDELE 1", @users[@ok_user])
+      end
+    end
+  end
+
   def test_popmail
     # totally not representative of real messages, but
     # enough to test frozen bugs