{"action":"opened","issue":{"url":"https://api.github.com/repos/andris9/smtp-server/issues/20","labels_url":"https://api.github.com/repos/andris9/smtp-server/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/andris9/smtp-server/issues/20/comments","events_url":"https://api.github.com/repos/andris9/smtp-server/issues/20/events","html_url":"https://github.com/andris9/smtp-server/issues/20","id":107136018,"number":20,"title":"Malicious clients can cause an unhandled exception","user":{"login":"farmdog","id":8467777,"avatar_url":"https://avatars.githubusercontent.com/u/8467777?v=3","gravatar_id":"","url":"https://api.github.com/users/farmdog","html_url":"https://github.com/farmdog","followers_url":"https://api.github.com/users/farmdog/followers","following_url":"https://api.github.com/users/farmdog/following{/other_user}","gists_url":"https://api.github.com/users/farmdog/gists{/gist_id}","starred_url":"https://api.github.com/users/farmdog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/farmdog/subscriptions","organizations_url":"https://api.github.com/users/farmdog/orgs","repos_url":"https://api.github.com/users/farmdog/repos","events_url":"https://api.github.com/users/farmdog/events{/privacy}","received_events_url":"https://api.github.com/users/farmdog/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-18T05:23:40Z","updated_at":"2015-09-18T05:23:40Z","closed_at":null,"body":"In smtp-connection's auth handler, it directly uses network input as a key with an object. If that key does not exist, then undefined will be returned, and immediately bind will be called, resulting in an exception. Can reproduce by:\r\nEHLO localhost\r\nAUTH evil\r\n\r\nCauses sasl[\"sasl_evil\"].bind(this) to be executed.\r\n\r\nI created a pull request with a possible fix."}}