FIX: Use addresses to compare email header (#14509)

Usually, when an email is received a user lookup is performed using the
email address found in the `From` header. When an email has an
`X-Original-From` header, if it is equal to `Reply-To` then it uses that
one instead. The comparison was sensitive to whitespaces and other
insignificant characters such as quotes because it reconstructed the
`From` header.

For the fixture added in this commit, it compared the reconstructed
`From` header `John Doe <johndoe@example.com>` with the `Reply-To`
header `"John Doe"    <johndoe@example.com>`.
This commit is contained in:
Dan Ungureanu 2021-10-05 12:42:19 +03:00 committed by GitHub
parent 6a143030f8
commit 74a9c0509b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 27 additions and 5 deletions

View File

@ -637,7 +637,8 @@ module Email
comparison_failed = false
comparison_headers.each do |comparison_header|
if mail_object[comparison_header].to_s != "#{from_display_name} <#{from_address}>"
comparison_header_address = mail_object[comparison_header].to_s[/<([^>]+)>/, 1]
if comparison_header_address != from_address
comparison_failed = true
break
end

View File

@ -870,8 +870,20 @@ describe Email::Receiver do
end
describe "reply-to header" do
it "handles emails where there is a Reply-To address, using that instead of the from address, if X-Original-From is present" do
before do
SiteSetting.block_auto_generated_emails = false
end
it "extracts address and uses it for comparison" do
expect { process(:reply_to_whitespaces) }.to change(Topic, :count).by(1)
user = User.last
incoming = IncomingEmail.find_by(message_id: "TXULO4v6YU0TzeL2buFAJNU2MK21c7t4@example.com")
topic = incoming.topic
expect(incoming.from_address).to eq("johndoe@example.com")
expect(user.email).to eq("johndoe@example.com")
end
it "handles emails where there is a Reply-To address, using that instead of the from address, if X-Original-From is present" do
expect { process(:reply_to_different_to_from) }.to change(Topic, :count).by(1)
user = User.last
incoming = IncomingEmail.find_by(message_id: "3848c3m98r439c348mc349@test.mailinglist.com")
@ -881,7 +893,6 @@ describe Email::Receiver do
end
it "allows for quotes around the display name of the Reply-To address" do
SiteSetting.block_auto_generated_emails = false
expect { process(:reply_to_different_to_from_quoted_display_name) }.to change(Topic, :count).by(1)
user = User.last
incoming = IncomingEmail.find_by(message_id: "3848c3m98r439c348mc349@test.mailinglist.com")
@ -891,7 +902,6 @@ describe Email::Receiver do
end
it "does not use the reply-to address if an X-Original-From header is not present" do
SiteSetting.block_auto_generated_emails = false
expect { process(:reply_to_different_to_from_no_x_original) }.to change(Topic, :count).by(1)
user = User.last
incoming = IncomingEmail.find_by(message_id: "3848c3m98r439c348mc349@test.mailinglist.com")
@ -901,7 +911,6 @@ describe Email::Receiver do
end
it "does not use the reply-to address if the X-Original-From header is different from the reply-to address" do
SiteSetting.block_auto_generated_emails = false
expect { process(:reply_to_different_to_from_x_original_different) }.to change(Topic, :count).by(1)
user = User.last
incoming = IncomingEmail.find_by(message_id: "3848c3m98r439c348mc349@test.mailinglist.com")

View File

@ -0,0 +1,12 @@
From: "'John Doe' via Forwarder" <team@bar.com>
To: "team@bar.com" <team@bar.com>
Subject: Greetings
Date: Wed, 01 Jan 2021 12:00:00 +0000
Message-ID: <TXULO4v6YU0TzeL2buFAJNU2MK21c7t4@example.com>
X-Original-Sender: johndoe@example.com
X-Original-From: "John Doe"
<johndoe@example.com>
Reply-To: "John Doe"
<johndoe@example.com>
Hello world!