Messages and attachments are read fully into memory with no size limit.
Sites:
internal/imap/client.go — GetMessage fetches the entire raw body; DownloadAttachment reads the whole part via io.ReadAllinternal/cli/mail.go — parseAttachments parses every attachment out of the raw body at once; DraftCreateCmd reads stdin unboundedinternal/smtp/client.go — outgoing attachments are read whole, base64-encoded into a second buffer, then accumulated in a bytes.Buffer for the multipart message
A large message or attachment is therefore bounded by available RAM rather than by anything configurable, and the SMTP send path holds roughly three copies at peak.
Only mail batch input is capped today (10 MB, in internal/cli/batch.go).
Low severity: exploiting it requires someone to send a very large message, and the impact is a failed command rather than compromise. Recorded as an accepted risk in docs/security-review.md for 0.2.6 rather than fixed, since a proper fix means streaming rather than a constant.
Streaming the SMTP attachment path would be the highest-value part, since it is the one that multiplies the data.
Messages and attachments are read fully into memory with no size limit.
Sites:
internal/imap/client.go—GetMessagefetches the entire raw body;DownloadAttachmentreads the whole part viaio.ReadAllinternal/cli/mail.go—parseAttachmentsparses every attachment out of the raw body at once;DraftCreateCmdreads stdin unboundedinternal/smtp/client.go— outgoing attachments are read whole, base64-encoded into a second buffer, then accumulated in abytes.Bufferfor the multipart messageA large message or attachment is therefore bounded by available RAM rather than by anything configurable, and the SMTP send path holds roughly three copies at peak.
Only
mail batchinput is capped today (10 MB, ininternal/cli/batch.go).Low severity: exploiting it requires someone to send a very large message, and the impact is a failed command rather than compromise. Recorded as an accepted risk in
docs/security-review.mdfor 0.2.6 rather than fixed, since a proper fix means streaming rather than a constant.Streaming the SMTP attachment path would be the highest-value part, since it is the one that multiplies the data.