fix(email): reject XOAUTH2 SASL delimiter injection

[seonghobae]

Security defect

generate_oauth2_string() interpolated the caller-provided user identity and OAuth access token directly into the SASL XOAUTH2 attribute stream, whose fields are delimited by 0x01. If either value itself contained 0x01, the generated authentication payload acquired caller-controlled field boundaries instead of representing exactly one user attribute and one auth=Bearer attribute.

TDD evidence

The initial exact head 4baff93834cb59e992c9bfd1fe1a7b944ef21377 added only two hostile-input regressions:

• delimiter injected through the user value;
• delimiter injected through the access token.

Production was unchanged on that head. Executing the exact pre-fix function against those cases produced no ValueError; decoding the resulting bytes showed the injected field boundaries, establishing the intended RED at the construction boundary. Predecessor-head workflow results are diagnostic history only.

Bounded GREEN implementation

Current exact head: 333285f877595cf0f23d32791af8874fb6b8af05.
Current protected base: develop@83ce2561e6566bc29a7abdecad6cd0a2e4ceb2a8.

The production helper rejects Control-A in either caller-controlled XOAUTH2 field before constructing or base64-encoding the SASL response. The ordinary payload contract remains unchanged. No credential logging, protocol fallback, IMAP/SMTP destination-policy expansion, token-policy change, or provider-specific authentication behavior was added.

The branch also adds docs/research/email-authentication-xoauth2/README.md, grounding the structural delimiter rule in RFC 7628 and Google's official Gmail XOAUTH2 wire-format documentation with APA 7 references and an explicit claim boundary.

Current exact-head gate state

On exact head 333285f877595cf0f23d32791af8874fb6b8af05:

• backend (Python 3.14): success;
• strix: success;
• opencode-review: success;
• coverage-evidence: success;
• repository governance metadata reports no current blocking check failure;
• no unresolved inline review thread is present at the latest refresh.

A fresh CodeRabbit review request was rate-limited and produced no formal review. Rate-limit text is not approval evidence. No current formal review is therefore counted as a qualifying independent approval.

Replacement boundary

This current-develop lane carries the intended security behavior from stale PR #1293 without its unrelated historical drift. #1293 is now closed and no old-head check or review evidence is reused here.

Merge gate

Do not merge until the unchanged current head has qualifying independent current-head review evidence and every live required context remains terminal-success under normal protected-branch rules. Queued, predecessor-head, stale, rate-limited, status-only, or model-only evidence is not success.

Summary by CodeRabbit

• Security

  • Improved email authentication validation by rejecting usernames and access tokens containing invalid SASL delimiter characters.

• Bug Fixes

  • Prevented malformed OAuth2 authentication payloads from being generated.

• Documentation

  • Added guidance on XOAUTH2 delimiter integrity, security boundaries, and verification requirements.

• Tests

  • Added regression coverage for invalid usernames and access tokens.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cfbad055-bcf5-4003-bf5a-d700a6e82eec

📥 Commits

Reviewing files that changed from the base of the PR and between 83ce256 and 333285f.

📒 Files selected for processing (3)

• backend/services/email_client.py
• backend/tests/test_email_client.py
• docs/research/email-authentication-xoauth2/README.md

---

📝 Walkthrough

Walkthrough

The email client now rejects SASL delimiter characters in XOAUTH2 usernames and access tokens. Parameterized tests verify the ValueError behavior. Documentation records the delimiter semantics, security claim boundaries, references, and verification requirements.

Changes

XOAUTH2 delimiter validation

Layer / File(s)	Summary
Validate XOAUTH2 fields backend/services/email_client.py, backend/tests/test_email_client.py, docs/research/email-authentication-xoauth2/README.md	generate_oauth2_string rejects SASL delimiter characters in usernames and access tokens. Parameterized tests assert the expected ValueError. Documentation describes the validation and its verification scope.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 33328

The PR adds focused rejection of XOAUTH2 delimiter injection while preserving the ordinary payload contract; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting XOAUTH2 SASL delimiter injection.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/xoauth2-delimiter-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate update for 333285f877595cf0f23d32791af8874fb6b8af05: no current blocking failures remain.

PR governance metadata gate is ready; all current-head requirements passed.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent review current exact head 333285f877595cf0f23d32791af8874fb6b8af05. CodeRabbit's current-head review did not start because of its review limit, so evaluate this exact head independently under the repository's structured adversarial-review contract. Do not reuse predecessor-head evidence.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent review current exact head 333285f877595cf0f23d32791af8874fb6b8af05. All current-head required checks are terminal-success at the latest refresh and no unresolved review thread is present. Evaluate only this exact head; predecessor or rate-limited review evidence is non-qualifying.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.