The smtplib module for SMTP. SMTP() uses plaintext unless starttls() is called. SMTP_SSL is the always-encrypted variant. Rule writers also target email header / recipient construction for header-injection sinks.
.SMTP_SSL().SMTP().sendmail().SMTP()Sinksmtplib.SMTP(host='', port=0, local_hostname=None, ...) -> SMTP
Opens a plaintext SMTP session. Finding if starttls is not called later.
.sendmail()SinkSMTP.sendmail(from_addr, to_addrs, msg, mail_options=(), rcpt_options=())
Sends an email. Header-injection sink when msg / to_addrs is user-controlled without sanitization.
1, 2.SMTP_SSL()Sanitizersmtplib.SMTP_SSL(host='', port=0, ..., context=None) -> SMTP_SSL
Opens an SMTP session over TLS. Safe.
return| FQN | Field | |
|---|---|---|
| smtplib | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PySmtplib