fix(security): harden PoW XSS, email header injection and UptimeKuma log redaction

pkg/mail/mail.go

@@ -12,6 +12,7 @@ import (
 	"net"
 	"net/smtp"
 	"strconv"
+	"strings"
 	"time"
 )
 
@@ -29,6 +30,14 @@ type Config struct {
 	Password string
 }
 
+// sanitizeHeaderValue removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeHeaderValue(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
 // SendMail sends an HTML email using the provided config and message details
 func SendMail(ctx context.Context, cfg Config, to string, subject, body string) error {
 	return SendMailHTML(ctx, cfg, to, subject, body)
@@ -40,9 +49,9 @@ func SendMailHTML(ctx context.Context, cfg Config, to string, subject, body stri
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"
 
@@ -212,9 +221,9 @@ func SendMailWithLog(ctx context.Context, cfg Config, to string, subject, body s
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"
 

pkg/mail/mail_test.go

@@ -90,3 +90,23 @@ func TestSendMailMock(t *testing.T) {
 		t.Errorf("failed to send mail: %v", err)
 	}
 }
+
+func TestSanitizeHeaderValue(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"plain", "System Notification", "System Notification"},
+		{"crlf stripped", "alert\r\nBcc: attacker@example.com", "alertBcc: attacker@example.com"},
+		{"cr stripped", "a\rb", "ab"},
+		{"lf stripped", "a\nb", "ab"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeHeaderValue(tt.input); got != tt.want {
+				t.Errorf("sanitizeHeaderValue(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}

pkg/push/email.go

@@ -19,6 +19,14 @@ func init() {
 // EmailPusher 极简 SMTP 邮件推送实现 (静态、解耦)
 type EmailPusher struct{}
 
+// sanitizeEmailHeader removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeEmailHeader(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
 // Send 发送邮件
 func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, _ string, ext map[string]any) error {
 	if cfg.URL == "" || cfg.Key == "" || cfg.Secret == "" {
@@ -57,9 +65,9 @@ func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body
 		}
 	}
 
-	subjectHeader := fmt.Sprintf("Subject: %s\r\n", title)
-	fromHeader := fmt.Sprintf("From: %s <%s>\r\n", fromName, from)
-	toHeader := fmt.Sprintf("To: %s\r\n", to)
+	subjectHeader := fmt.Sprintf("Subject: %s\r\n", sanitizeEmailHeader(title))
+	fromHeader := fmt.Sprintf("From: %s <%s>\r\n", sanitizeEmailHeader(fromName), sanitizeEmailHeader(from))
+	toHeader := fmt.Sprintf("To: %s\r\n", sanitizeEmailHeader(to))
 	mimeHeader := "MIME-version: 1.0;\r\nContent-Type: text/html; charset=\"UTF-8\";\r\n\r\n"
 
 	// 拼装完整的邮件报文

pkg/push/email_test.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import "testing"
+
+func TestSanitizeEmailHeader(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"plain", "System Notification", "System Notification"},
+		{"crlf stripped", "alert\r\nBcc: attacker@example.com", "alertBcc: attacker@example.com"},
+		{"cr stripped", "a\rb", "ab"},
+		{"lf stripped", "a\nb", "ab"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeEmailHeader(tt.input); got != tt.want {
+				t.Errorf("sanitizeEmailHeader(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}