cfmail subject doesn't sanitise new lines


The following code (change someone@import.ant to yourself, obviously) on lucee will result in a mangled email. ACF11 properly strips the newlines from the subject.

Relevant headers from the mail source





Igal Sapir
November 8, 2016, 7:22 PM

It seems to me that the "correct" way to fix this issue is not to strip out whitespace characters, but rather inject a whitespace character after a newline if there is none, so to take the OP's example, it will inject a whitespace character (space) just before the word "End", effectively changing


The other option is to become ACF compatible and remove all of the subsequent non-space whitespace.

Joseph Gooch
November 8, 2016, 7:45 PM

My goal would be that there's no way for a user to shoot themselves in the foot with cfmail - it should always be legit, and the user shouldn't have to know the SMTP spec to accomplish that.

To that end, line folding is just a way in the SMTP spec to do really long headers - the only reason to do that on purpose is if you care what "view source" looks like. If there's line folding, I would expect the SMTP library to do that. (Especially because the other end is going to remove the newlines and concatenate anyway, so it really is just a cosmetic source issue)

I'd do subject.replace(/(\r|\n|[^[:isprint:]])+/g, " "); and let the header wrap (if necessary) where it may.

(In English - remove all consecutive sequences of newline, CR, and non printable characters with a single space)

Igal Sapir
November 8, 2016, 10:19 PM

OK, then it looks like we're going the "ACF Way" on this:

Trim the subject and replace all whitespace with chr(32), removing all consecutive whitespace characters.

Pothys - MitrahSoft
February 6, 2018, 7:40 AM

HI ,

I've checked with latest version of lucee stil the issue is reproduced. Still you need more input on this ticket?

Igal Sapir
June 1, 2018, 6:53 PM

Subject line is now trimmed and subsequent whitespace characters are removed. The single whitespace characters that remain are converted to a standard chr(32) space if they are a different character.



Igal Sapir


Ben Bluemel




Fix versions



Affects versions