flashmob/Guerrilla-SMTPd — pull request #7 by myselfhimself (2014-09-11 12:08:18+00:00)
Title: smtpd.php: avoiding SMTP command false positive search in body/multipart...

... payloads

When an e-mail body has a lot of content (eg. long and strange body or several attachments parts), checking for SMTP commands using if(stripos($input, 'MYCOMMAND') !== false) could trigger a false positive when MYCOMMAND actually is in the body (encountered 3 times over 10 different .png attachments, see below). This pull request proposes to force checking that commands exactly start exactly at the beginning of line of $input. This helped our server not mixing up attachments and commands.

For proof, here are examples of case-insentive HELO occurences in our attachments within $input:
$ grep helo logs/smtpd_out -i
jrnut4oIplgPlx+HJGkLVsrhqEb7Ml2IHeLOKq16e2NqYn5XqppPLVZXRRDrgJODtK63cnM4N2Bi
0a2NcbYGUHM3PDXDbVONFLfVplxfwRHHelOHo3OZzKvRLPA4P9PV2YywaMGFKTZkbcASMqoLikGg
jrnut4oIplgPlx+HJGkLVsrhqEb7Ml2IHeLOKq16e2NqYn5XqppPLVZXRRDrgJODtK63cnM4N2Bi
jrnut4oIplgPlx+HJGkLVsrhqEb7Ml2IHeLOKq16e2NqYn5XqppPLVZXRRDrgJODtK63cnM4N2Bi
0a2NcbYGUHM3PDXDbVONFLfVplxfwRHHelOHo3OZzKvRLPA4P9PV2YywaMGFKTZkbcASMqoLikGg
jrnut4oIplgPlx+HJGkLVsrhqEb7Ml2IHeLOKq16e2NqYn5XqppPLVZXRRDrgJODtK63cnM4N2Bi
jrnut4oIplgPlx+HJGkLVsrhqEb7Ml2IHeLOKq16e2NqYn5XqppPLVZXRRDrgJODtK63cnM4N2Bi
0a2NcbYGUHM3PDXDbVONFLfVplxfwRHHelOHo3OZzKvRLPA4P9PV2YywaMGFKTZkbcASMqoLikGg