Thanks to visit codestin.com
Credit goes to github.com

Skip to content

fix: ensure message content is not modified by header filter #4429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
georglauterbach merged 1 commit into from
Mar 25, 2025
Merged

fix: ensure message content is not modified by header filter #4429

georglauterbach merged 1 commit into from
Mar 25, 2025

Conversation

@mpldr
Copy link
Contributor

@mpldr mpldr commented Mar 24, 2025

Due to an oversight, one of the header filters has potentially modified the message body, leading to broken cryptographic signatures.

Switch to the Message-Id instead of the Content-Type header, which is usually only present in the global header.

Reported-by: Cole Young [email protected]
Fixes: 009237c ("chore: Prevent Microsoft MUAs from sending reactions (#4120)")

@mpldr mpldr mentioned this pull request Mar 24, 2025
Closed
8 tasks
@georglauterbach georglauterbach self-requested a review March 24, 2025 13:26
polarathene
polarathene requested changes Mar 25, 2025
View reviewed changes
Copy link
Member

@polarathene polarathene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks, just an improvement to the changelog.

@polarathene polarathene added this to the v15.0.2 milestone Mar 25, 2025
casperklein
casperklein previously approved these changes Mar 25, 2025
View reviewed changes
@mpldr @georglauterbach
fix: ensure message content is not modified by header filter
e713cb5 
Due to an oversight, one of the header filters has potentially modified
the message body, leading to broken cryptographic signatures.

Switch to the Message-Id instead of the Content-Type header, which is
usually only present in the global header.

Signed-off-by: Moritz Poldrack <[email protected]>
Co-Authored-by: Georg Lauterbach <[email protected]>
Reported-by: Cole Young <[email protected]>
Fixes: 009237c ("chore: Prevent Microsoft MUAs from sending reactions (docker-mailserver#4120)")
@mpldr mpldr dismissed stale reviews from casperklein and georglauterbach via e713cb5 March 25, 2025 21:37
@mpldr
Copy link
Contributor Author

mpldr commented Mar 25, 2025

Done as requested :)

@casperklein
Copy link
Member

casperklein commented Mar 25, 2025

Not related to this PR: Does anyone knows, why there are these \s* in the regex? If never saw mail headers prefixed by space(s).

@georglauterbach
Copy link
Member

georglauterbach commented Mar 25, 2025

Not related to this PR: Does anyone knows, why there are these \s* in the regex? If never saw mail headers prefixed by space(s).

I don't know either. I'll revise this after afterward anyway, the whitespaces are very likely not required.

@georglauterbach georglauterbach enabled auto-merge (squash) March 25, 2025 23:04
@polarathene
Copy link
Member

polarathene commented Mar 25, 2025

I'll revise this after afterward anyway, the whitespaces are very likely not required.

FWIW, I did investigate this feature in DMS and it looks like it had a poor implementation to begin with: #4263 (comment)

AFAIK, this was intended only for affecting mail sent from Postfix, but looks like it was misconfigured to also apply to mail arriving to Postfix to give to Dovecot.

@georglauterbach georglauterbach merged commit c2c48b2 into docker-mailserver:master Mar 25, 2025
7 checks passed
@polarathene polarathene mentioned this pull request Mar 25, 2025
Open
53 tasks
@georglauterbach
Copy link
Member

georglauterbach commented Mar 26, 2025 •
edited
Loading

Do we want to release v15.0.2 right away?

@mpldr
Copy link
Contributor Author

mpldr commented Mar 26, 2025

Not sure how frequently its encountered, but I would think those who are would very much appreciate a timely fix.

@polarathene
Copy link
Member

polarathene commented Mar 26, 2025

Do we want to release v15.0.2 right away?

Given the regression that'd be wise to do. Anything else that props up over the next week can go into a .3 release if needed before merging in changes for 15.1.

@georglauterbach
Copy link
Member

georglauterbach commented Mar 26, 2025

ref #4432

@polarathene polarathene mentioned this pull request Nov 21, 2025
Open
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@casperklein casperklein casperklein approved these changes

@polarathene polarathene polarathene approved these changes

@georglauterbach georglauterbach georglauterbach approved these changes

Assignees

@mpldr mpldr

Labels

area/configuration (file) kind/bug/fix A fix (PR) for a confirmed bug priority/high service/postfix

Projects

None yet

Milestone

v15.0.2

Development

Successfully merging this pull request may close these issues.

4 participants

@mpldr @casperklein @georglauterbach @polarathene