SMTP Command Injection in Appointment Emails via Newlines

Summary: Users can create appointment calendars for other users to book slots on their calendar. When booking a slot, the following request is made:

POST /apps/calendar/appointment/1/book HTTP/2
Host: 192.168.92.132

{"start":1647306900,"end":"1647307200","displayName":"Test User","email":"<BOOKING USER'S EMAIL>","description":"Please accept!\r\n","timeZone":"Asia/Singapore"}