fix: never merge outer To headers if standard header protection is used

src/chat/chat_tests.rs

@@ -6576,3 +6576,34 @@ async fn test_unpromoted_group_start_message() -> Result<()> {
 
     Ok(())
 }
+
+/// Tests that outer To header is ignored for broadcast messages.
+///
+/// Broadcast messages have no recipients in the To field,
+/// but this does not mean that outer To field should be used.
+///
+/// With RFC 9788 header protection all outer headers should be ignored.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_broadcast_message_replaced_to() -> Result<()> {
+    let mut tcm = TestContextManager::new();
+    let alice = &tcm.alice().await;
+    let bob = &tcm.bob().await;
+
+    let alice_broadcast_id = create_broadcast(alice, "Channel".to_string()).await?;
+    let qr = get_securejoin_qr(alice, Some(alice_broadcast_id))
+        .await
+        .unwrap();
+    let bob_chat_id = tcm.exec_securejoin_qr(bob, alice, &qr).await;
+
+    let mut sent = alice.send_text(alice_broadcast_id, "Hello!").await;
+    sent.payload = sent
+        .payload
+        .replace("To: ", "To: mallory@example.org\r\nX-Foobar: ");
+    let bob_msg = bob.recv_msg(&sent).await;
+
+    // The message should be assigned to the broadcast chat
+    // and not to some ad hoc group with mallory@example.org
+    assert_eq!(bob_msg.chat_id, bob_chat_id);
+
+    Ok(())
+}

src/mimeparser.rs

@@ -1739,6 +1739,10 @@ impl MimeMessage {
                 .extract_if(|k, _v| has_header_protection || is_protected(k))
                 .map(|(k, _v)| k.to_string()),
         );
+
+        if has_header_protection {
+            *chat_disposition_notification_to = None;
+        }
         for field in fields {
             // lowercasing all headers is technically not correct, but makes things work better
             let key = field.get_key().to_lowercase();
@@ -1755,20 +1759,20 @@ impl MimeMessage {
             }
         }
         let recipients_new = get_recipients(fields);
-        if !recipients_new.is_empty() {
+        if has_header_protection || !recipients_new.is_empty() {
             *recipients = recipients_new;
         }
         let past_members_addresses =
             get_all_addresses_from_header(fields, "chat-group-past-members");
-        if !past_members_addresses.is_empty() {
+        if has_header_protection || !past_members_addresses.is_empty() {
             *past_members = past_members_addresses;
         }
         let from_new = get_from(fields);
-        if from_new.is_some() {
+        if has_header_protection || from_new.is_some() {
             *from = from_new;
         }
         let list_post_new = get_list_post(fields);
-        if list_post_new.is_some() {
+        if has_header_protection || list_post_new.is_some() {
             *list_post = list_post_new;
         }
     }