{"record":{"id":"7c81a4bdf77d5ac8","repo":"jstedfast/MailKit","slug":"the-address-cannot-contain-newline-characters","errorCode":null,"errorMessage":"The address cannot contain newline characters.","messagePattern":"The address cannot contain newline characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"MailKit/Net/Smtp/SmtpClient.cs","lineNumber":2765,"sourceCode":"\t\t/// An SMTP protocol exception occurred.\n\t\t/// </exception>\n\t\tpublic InternetAddressList Expand (string alias, CancellationToken cancellationToken = default)\n\t\t{\n\t\t\tvar response = SendCommandInternal (CreateExpandCommand (alias), cancellationToken);\n\n\t\t\treturn ParseExpandResponse (response);\n\t\t}\n\n\t\tstring CreateVerifyCommand (string address)\n\t\t{\n\t\t\tif (address == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (address));\n\n\t\t\tif (address.Length == 0)\n\t\t\t\tthrow new ArgumentException (\"The address cannot be empty.\", nameof (address));\n\n\t\t\tif (address.IndexOfAny (NewLineCharacters) != -1)\n\t\t\t\tthrow new ArgumentException (\"The address cannot contain newline characters.\", nameof (address));\n\n\t\t\tCheckDisposed ();\n\n\t\t\tif (!IsConnected)\n\t\t\t\tthrow new ServiceNotConnectedException (\"The SmtpClient is not connected.\");\n\n\t\t\treturn string.Format (\"VRFY {0}\\r\\n\", address);\n\t\t}\n\n\t\tstatic MailboxAddress ParseVerifyResponse (SmtpResponse response)\n\t\t{\n\t\t\tif (response.StatusCode == SmtpStatusCode.Ok)\n\t\t\t\treturn MailboxAddress.Parse (response.Response);\n\n\t\t\tthrow new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);\n\t\t}\n\n\t\t/// <summary>","sourceCodeStart":2747,"sourceCodeEnd":2783,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Net/Smtp/SmtpClient.cs#L2747-L2783","documentation":"SmtpClient.Verify/CreateVerifyCommand throws ArgumentException when the address contains newline characters (CR/LF). Newlines would let an attacker smuggle additional SMTP commands (VRFY injection), so the library explicitly rejects addresses containing them.","triggerScenarios":"Passing an address containing '\\r' or '\\n', e.g. from untrusted request input, multi-line text pasted into a form, or CSV/file data not stripped of line endings.","commonSituations":"Email harvested from raw file lines without trimming the trailing newline; attackers probing for SMTP header/command injection; log-derived addresses including separators.","solutions":["Trim and strip CR/LF from the address before calling Verify","Validate the address against a strict email pattern (which excludes newlines) before the call","Reject newline-containing input at the application boundary as a validation error"],"exampleFix":"// before\nawait smtpClient.VerifyAsync(lineFromCsv); // may end with \\n\n// after\nvar addr = lineFromCsv?.Trim('\\r', '\\n').Trim();\nif (!string.IsNullOrEmpty(addr) && !addr.Contains('\\n') && !addr.Contains('\\r'))\n    await smtpClient.VerifyAsync(addr);","handlingStrategy":"validation","validationCode":"if (address == null || address.IndexOfAny(new[] {'\\r','\\n'}) != -1)\n    throw new ArgumentException(\"Address must not contain newlines\", nameof(address));\nawait smtpClient.VerifyAsync(address);","typeGuard":"bool IsSafeAddress(string a) =>\n    !string.IsNullOrEmpty(a) && a.IndexOfAny(new[] {'\\r','\\n'}) == -1;","tryCatchPattern":"try {\n    var result = await smtpClient.VerifyAsync(address);\n} catch (ArgumentException) {\n    logger.LogWarning(\"VRFY address contained newlines (possible injection)\");\n}","preventionTips":["Trim CR/LF from values read from files or forms","Reject addresses failing a strict email regex","Sanitize untrusted input at the boundary before SMTP calls"],"tags":["smtp","validation","security","mailkit"],"backgroundTag":"invalid-argument-format","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}