digest: pass in the user name quoted (as well)

[bagder]

For cases where the user puts a double quote or backspace in the user name.

Adjusted test 907 to verify

Reported-by: am-perip on hackerone

[Copilot]

Pull request overview

Updates DIGEST-MD5 SASL authentication message generation to properly quoted-string escape the username (in addition to realm/nonce), and adjusts a regression test to validate usernames containing special characters.

Changes:

• Escape (backslash-quote) the DIGEST-MD5 username field using the existing quoted-string helper.
• Update test907 to use/verify a username containing a double quote.
• Update tests/data/Makefile.am test case list (currently introduces a missing test entry).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/data/test907	Adjusts SMTP DIGEST-MD5 test vectors to use/verify a quoted username.
tests/data/Makefile.am	Modifies the enumerated test case list (currently references a non-existent test).
lib/vauth/digest.c	Escapes the DIGEST-MD5 username attribute before formatting the response string.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: Ensures DIGEST-MD5 responses properly escape the username when it contains characters like " or </code>.
Changes: Adds username quoting via auth_digest_string_quoted() and updates SMTP test 907 to validate the new behavior.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.