Affected: RubyGems: net-imap

### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain contain `CRLF` sequences, which an attacker can use to inject arbitrary IMAP commands.

### Details

`Net::IMAP`'s generic argument handling, used by most command arguments, interprets string arguments as an IMAP `astring`. Depending on the string contents and the connection's UTF-8 support, this encodes strings as either a `atom`, `quoted`, or `literal`. These are safe from command or argument injection.

But the following commands transform specific String arguments to `Net::IMAP::RawData`, which bypasses normal argument validation and encoding and prints the string directly to the socket: * `#uid_search`, `#search`, `#uid_sort`, `#sort`, `#uid_thread`, `#thread` * when `criteria` is a String, it is sent raw * `#uid_fetch`, `#fetch * when `attr` is a String, it is sent raw * when `attr` is an Array, each String in `attr` is sent raw * `#uid_store`, `#store` * when `attr` is a String, it is sent raw * `#setquota`: * `limit` is interpolated with `#to_s` and that string is sent raw

Because these string arguments are sent without any neutralization, they serve as a direct vector for command splitting. Any user controlled data interpolated into these strings can be used to break out of the intended command context.

Using \"raw data\" arguments for `#uid_store`, `#sto…