[Bug 8340] DMARC avoidance

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8340

--- Comment #8 from Giovanni Bechis <[email protected]> ---
(In reply to Kent Oyer from comment #7)
> First minor nitpick: Your regex has '\s' twice.
> 
> Second minor nitpick: Your patch seems to fix the DMARC issue however so
> does this much simpler patch:
> 
> @@ -2640,10 +2640,6 @@
>      if (defined $2) {
>        # Remove comments (no nested support here)
>        $address =~ s/\((?:|(?:[^()\\]++|\\.)*+)\)//gs;
> -      # Validate as somewhat email looking
> -      if ($address !~ /^$header_address_mailre$/) {
> -        $address = undef;
> -      }
>      }
> 
I've tried this, however, with this approach this email address will not be
checked by DMARC (and other) rules:
"Support" <[email protected]/support> 

> 
> In other words, don't set $address to undef if it doesn't validate. By
> removing invalid chars you are preventing other tests from checking for
> these invalid chars. Your patch converts "no reply" to "noreply" but if I
> have this rule:
> 
> header   RULE_NAME   From:addr =~ /no reply/
> 
> it will not fire.
maybe removing invalid chars after the domain like this might be enough.

Index: lib/Mail/SpamAssassin/Util.pm
===================================================================
--- lib/Mail/SpamAssassin/Util.pm       (revision 1927536)
+++ lib/Mail/SpamAssassin/Util.pm       (working copy)
@@ -2640,9 +2640,14 @@
     if (defined $2) {
       # Remove comments (no nested support here)
       $address =~ s/\((?:|(?:[^()\\]++|\\.)*+)\)//gs;
+      # Remove extra chars added after the domain
+      if($address =~ /(.*\@.*)[\x00-\x1F\x7F\s<>()[\]\\,;:\/"]/) {
+        $address = $1;
+      }
       # Validate as somewhat email looking
       if ($address !~ /^$header_address_mailre$/) {
         $address = undef;
       }
     }

-- 
You are receiving this mail because:
You are the assignee for the bug.