Is Craft's Email Service Protected Against Mail Header Injection Attacks?

Question

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www.acunetix.com/blog/articles/email-header-injection/).

I've reached out to Ben at Barrel Strength and his response was that Sprout Forms uses the default Craft email service so any security steps Craft is taking they're piggybacking on.

The site is currently using the PHP Mail email setting.

Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks or would we need to implement any updates to protect against this?

Answer 1

Does the Craft email service have any protection / validation in place to mitigate against potential Mail Header Injection attacks

Yes.

Attacks like this, for the most part, are really only a concern for PHP apps that roll with their own custom email logic instead of using a widely used/tested email library. Craft 2 uses PHPMailer and Craft 3 uses SwiftMailer.

And they both provide methods for stripping out newlines to prevent header injection attacks.