webmail

mirror of https://github.com/bulwarkmail/webmail.git synced 2026-10-31 16:13:15 +00:00

Files

T

Linus Rath 8f7124c878 fix: stop a sender from faking a DMARC or DKIM pass in the security badges

The Authentication-Results parser matched `dmarc=` and `dkim=` anywhere
in all headers joined together. A sender who used `dmarc=pass@...` as
the envelope address got a green DMARC pass for a message that failed,
because the server echoes that address in the SPF clause before its
real `dmarc=fail`. A sender could also add their own
Authentication-Results header to an unsigned message and get a DKIM and
DMARC pass. Calendar invites from such a message were shown as trusted.

The parser now splits each header on `;` outside quoted strings and
comments and reads the method only at the start of a part. DKIM, DMARC
and iprev come from the topmost header, which the receiving server
wrote; lower headers can only escalate SPF to a failure.

2026-09-26 14:13:33 +02:00

__tests__

fix: gate first-touch calendar/contacts requests to stop duplicate default calendars #907

2026-08-25 19:07:01 +02:00

client-interface.ts

fix: use the from override as envelope sender where the server allows it #1009

2026-09-23 19:58:26 +02:00

client.ts

fix: stop a sender from faking a DMARC or DKIM pass in the security badges

2026-09-26 14:13:33 +02:00

contact-wire.ts

fix: save contacts with calendar links and cleared fields correctly