imap-login: Don't allow IMAP command tags that have invalid characters. This simply attempts to prevent HTTP requests from replying with any potentially danerous data that some web browsers might execute, e.g.:
imap-login: Don't allow IMAP command tags that have invalid characters.
This simply attempts to prevent HTTP requests from replying with any
potentially danerous data that some web browsers might execute, e.g.:

curl --request POST -F 'x="<script>alert(1)</script>"' http://localhost:143/

The above command probably doesn't work, because max. bad commands is
reached earlier. But if it isn't, this change makes sure it doesn't return
back anything, because '"' and '(' aren't allowed characters. Even if '"'
weren't required, there hopefully isn't much to be done without being able
to call any functions.

jwm/dovecot-notmuch,jkerihuel/dovecot,jwm/dovecot-notmuch,jwm/dovecot-notmuch,jkerihuel/dovecot,jkerihuel/dovecot,jwm/dovecot-notmuch,jwm/dovecot-notmuch,jkerihuel/dovecot,jkerihuel/dovecot