Client::starttls() does not check for capability

[felinira]

StartTLS must only be used when the server has the STARTTLS capability. Considering the fact that connection has already commenced, the only option would be to terminate the connection again.

[duesee]

(Talking to myself a bit in case someone with less STARTTLS experience reads it.)

Trying to find out if the server supports STARTTLS or not leads to security vulnerabilities. See the "Negotiation" column on page 4376 (https://www.usenix.org/system/files/sec21-poddebniak.pdf)

Also, exposing the client to unencrypted IMAP responses exposes it to "Tampering" and "UI Spoofing" attacks, e.g., an attacker can create fake mailboxes and emails before STARTTLS.

In the plaintext phase, nothing the server sends is trustworthy. Not the capabilities, and also not the response to the STARTTLS command itself. Thus, I would recommend to even go one step further: We should not even parse anything the server sends in plaintext. Just always send the STARTTLS command and try the TLS handshake doing a bare minimum of parsing. If that fails, good, then we needed to terminate the connection anyway.