{"record":{"id":"403b91123dc901a0","repo":"jstedfast/MailKit","slug":"the-alias-cannot-contain-newline-characters","errorCode":null,"errorMessage":"The alias cannot contain newline characters.","messagePattern":"The alias cannot contain newline characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Smtp/SmtpClient.cs","lineNumber":2684,"sourceCode":"\t\tpublic override string Send (FormatOptions options, MimeMessage message, MailboxAddress sender, IEnumerable<MailboxAddress> recipients, CancellationToken cancellationToken = default, ITransferProgress? progress = null)\n\t\t{\n\t\t\tvar rcpts = ValidateArguments (options, message, sender, recipients);\n\n\t\t\treturn Send (options, message, sender, rcpts, cancellationToken, progress);\n\t\t}\n\n\t\t#endregion\n\n\t\tstring CreateExpandCommand (string alias)\n\t\t{\n\t\t\tif (alias == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (alias));\n\n\t\t\tif (alias.Length == 0)\n\t\t\t\tthrow new ArgumentException (\"The alias cannot be empty.\", nameof (alias));\n\n\t\t\tif (alias.IndexOfAny (NewLineCharacters) != -1)\n\t\t\t\tthrow new ArgumentException (\"The alias cannot contain newline characters.\", nameof (alias));\n\n\t\t\tCheckDisposed ();\n\n\t\t\tif (!IsConnected)\n\t\t\t\tthrow new ServiceNotConnectedException (\"The SmtpClient is not connected.\");\n\n\t\t\treturn string.Format (\"EXPN {0}\\r\\n\", alias);\n\t\t}\n\n\t\tstatic InternetAddressList ParseExpandResponse (SmtpResponse response)\n\t\t{\n\t\t\tif (response.StatusCode != SmtpStatusCode.Ok)\n\t\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\n\t\t\tvar lines = response.Response.Split ('\\n');\n\t\t\tvar list = new InternetAddressList ();\n\n\t\t\tfor (int i = 0; i < lines.Length; i++) {","sourceCodeStart":2666,"sourceCodeEnd":2702,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Smtp/SmtpClient.cs#L2666-L2702","documentation":"SmtpClient.Expand/CreateExpandCommand throws ArgumentException when the alias contains newline characters (CR or LF). Newlines in an SMTP command enable command injection (smuggling extra SMTP verbs), so the library explicitly rejects any alias containing them.","triggerScenarios":"Passing an alias that contains '\\n' or '\\r', typically from multi-line user input, untrusted request data, or log/text files parsed without newline stripping.","commonSituations":"Copying an alias from a text file/email body including a trailing newline; accepting raw multi-line form input; security scanners flagging injection risk when newline validation is bypassed.","solutions":["Strip or reject newline characters before calling Expand (alias.Replace(\"\\r\",\"\").Replace(\"\\n\",\"\"))","Validate the alias against a safe pattern (e.g. letters, digits, dots, dashes) before the call","Treat newline-containing input as a validation error at the application boundary"],"exampleFix":"// before\nawait smtpClient.ExpandAsync(userInput); // may contain newlines\n// after\nvar alias = userInput?.Replace(\"\\r\", \"\").Replace(\"\\n\", \"\").Trim();\nif (!string.IsNullOrEmpty(alias))\n    await smtpClient.ExpandAsync(alias);","handlingStrategy":"validation","validationCode":"if (alias == null || alias.IndexOfAny(new[] {'\\r','\\n'}) != -1)\n    throw new ArgumentException(\"Alias must not contain newlines\", nameof(alias));\nawait smtpClient.ExpandAsync(alias);","typeGuard":"bool IsSafeAlias(string a) =>\n    !string.IsNullOrEmpty(a) && a.IndexOfAny(new[] {'\\r','\\n'}) == -1;","tryCatchPattern":"try {\n    var list = await smtpClient.ExpandAsync(alias);\n} catch (ArgumentException) {\n    logger.LogWarning(\"EXPN alias contained newline characters (possible injection)\");\n}","preventionTips":["Sanitize all externally supplied SMTP command arguments","Strip CR/LF at the input boundary, not at the send site","Use strict allow-list patterns for aliases"],"tags":["smtp","validation","security","mailkit"],"backgroundTag":"invalid-argument-format","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}