Check for spoofed sender addresses, only display the address if so.

This adds a check for malware spoofing of RFC 822 mailbox addresses such
as those found in Mailsploit, and if found only displays the email
address part and not the mailbox name part.

Part 1 of Mailsploit mitigation.

* src/engine/rfc822/rfc822-mailbox-address.vala (MailboxAddress): Add new
  is_spoofed method to check if the mailbox address looks like it has
  been spoofed. Add is_distinct method to determine if the name and the
  label is the same. Do whitespace and non-printing character stripping
  when generating display versions of the mailbox address, rename methods
  to make it more obvious what they do and update call sites. Add unit
  tests to cover all this.

* src/client/conversation-viewer/conversation-message.vala
  (ConversationMessage): Check name is distinct and is not valid before
  displaying it. Use new MailboxAddress methods for getting display
  versions of the address, to ensure we get the stripped versions of the
  addresses.

* src/client/conversation-list/formatted-conversation-data.vala
  (ParticipantDisplay): Ensure full addresses are always HTML-markup
  escaped before displaying them as markup, to avoid dropping "<address>"
  values as invalid HTML. Always show the full address if an address is
  invalid.

* src/engine/util/util-string.vala (reduce_whitespace): Strip not only
  whitespace but also non-printing characters. Add unit tests.
This commit is contained in:
Michael James Gratton 2018-01-29 09:57:24 +10:30
parent f6b4b5c9e8
commit 71e0e6835e
14 changed files with 369 additions and 108 deletions

View file

@ -0,0 +1,47 @@
/*
* Copyright 2018 Michael Gratton <mike@vee.net>
*
* This software is licensed under the GNU Lesser General Public License
* (version 2.1 or later). See the COPYING file in this distribution.
*/
class Geary.String.Test : Gee.TestCase {
public Test() {
base("Geary.String.Test");
add_test("test_whitespace", test_whitespace);
add_test("test_nonprinting", test_nonprinting);
}
public void test_whitespace() {
assert(reduce_whitespace("") == "");
assert(reduce_whitespace(" ") == "");
assert(reduce_whitespace(" ") == "");
assert(reduce_whitespace(" ") == "");
assert(reduce_whitespace("test") == "test");
assert(reduce_whitespace("test ") == "test");
assert(reduce_whitespace("test ") == "test");
assert(reduce_whitespace("test\n") == "test");
assert(reduce_whitespace("test\r") == "test");
assert(reduce_whitespace("test\t") == "test");
assert(reduce_whitespace(" test") == "test");
assert(reduce_whitespace(" test") == "test");
assert(reduce_whitespace("test test") == "test test");
assert(reduce_whitespace("test test") == "test test");
assert(reduce_whitespace("test\ntest") == "test test");
assert(reduce_whitespace("test\n test") == "test test");
assert(reduce_whitespace("test \ntest") == "test test");
assert(reduce_whitespace("test \n test") == "test test");
assert(reduce_whitespace("test\rtest") == "test test");
assert(reduce_whitespace("test\ttest") == "test test");
}
public void test_nonprinting() {
assert(reduce_whitespace("\0") == ""); // NUL
assert(reduce_whitespace("\u00A0") == ""); // ENQUIRY
assert(reduce_whitespace("\u00A0") == ""); // NO-BREAK SPACE
assert(reduce_whitespace("\u2003") == ""); // EM SPACE
assert(reduce_whitespace("test\n") == "test");
assert(reduce_whitespace("test\ntest") == "test test");
}
}