Mirrors/chatmail-core
1
0
Fork 0
mirror of https://github.com/chatmail/core.git synced 2026-04-17 21:46:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: Reject message with forged From even if no valid signatures are found

Browse Source 
There are many reasons why we may fail to find valid signatures in a message, e.g. we don't yet know
a public key attached in the same message, anyway, if From is forged, the message must be rejected.

Also always take the displayname from encrypted From, even if no valid signatures are found.
This commit is contained in:
iequidoo
2024-07-22 13:33:05 -03:00
committed by iequidoo
parent a710c034e4
commit 04fd2cdcab
2 changed files with 40 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
src/receive_imf/tests.rs
View File

@@ -3559,6 +3559,39 @@ async fn test_prefer_encrypt_mutual_if_encrypted() -> Result<()> {
Ok(())
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn test_forged_from_and_no_valid_signatures() -> Result<()> {
let t = &TestContext::new_bob().await;
let raw = include_bytes!("../../test-data/message/thunderbird_encrypted_signed.eml");
let received_msg = receive_imf(t, raw, false).await?.unwrap();
assert!(!received_msg.from_is_signed);
let msg = t.get_last_msg().await;
assert!(!msg.chat_id.is_trash());
assert!(!msg.get_showpadlock());
let t = &TestContext::new_bob().await;
let raw = String::from_utf8(raw.to_vec())?.replace("alice@example.org", "clarice@example.org");
let received_msg = receive_imf(t, raw.as_bytes(), false).await?.unwrap();
assert!(received_msg.chat_id.is_trash());
Ok(())
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn test_wrong_from_name_and_no_valid_signatures() -> Result<()> {
let t = &TestContext::new_bob().await;
let raw = include_bytes!("../../test-data/message/thunderbird_encrypted_signed.eml");
let raw = String::from_utf8(raw.to_vec())?.replace("From: Alice", "From: A");
let received_msg = receive_imf(t, raw.as_bytes(), false).await?.unwrap();
assert!(!received_msg.from_is_signed);
let msg = t.get_last_msg().await;
assert!(!msg.chat_id.is_trash());
assert!(!msg.get_showpadlock());
let contact = Contact::get_by_id(t, msg.from_id).await?;
assert_eq!(contact.get_authname(), "Alice");
Ok(())
}
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
async fn test_thunderbird_autocrypt_unencrypted() -> Result<()> {
let t = TestContext::new_bob().await;