Re[2]: svn commit: r1934386 - spamassassin/trunk/rules

------=_Part_262_627670374.1779264920
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi Giovanni,=0AYou make a fair point about this being an unexpected chang=
e for users running 4.0.2 pre-1934332. After a bit of pondering, I have t=
wo responses/concerns (both IMHO):=0A1. Probing URLs we haven't vetted is=
 risky and equally unexpected. If SA's probe ends up unsubscribing a user=
 from a list, or approving/denying a request on their behalf, that's a fa=
r worse surprise than a missing redirector match. An argument could even =
be made that a lenient allowlist is itself an attack surface. A crafted s=
pam message can direct SA to fire HTTP requests at attacker-chosen URLs o=
n any allowlisted host, from the recipient's mail-server IP. The narrower=
 the allowlist, the smaller the risk.=0A2. The .cf file is a curated allo=
wlist, not part of the API. I think users expect us to maintain it as we =
learn more about which hosts are abusable and how they operate. Pruning e=
ntries that don't meet the standard for inclusion is part of that mainten=
ance. For instance, the documentation in the .cf file states:=0A# Please =
only add entries that you manually verified as actual working=0A# redirec=
tors that can have abusable custom URLs.  Adding non-abusable=0A# service=
s only generates unnecessary HTTP requests.=0ASo the criteria for inclusi=
on are: (1) actual working redirector and (2) from an abusable service. I=
ncluding hosts that may-or-may-not be working redirectors seems contrary =
to that advice.=0AHere are a few examples for discussion:=0A1. google[.]c=
om/search=0AIt may be abused, but it's not a redirector. It returns a 200=
 response along with a search results page. There's no Location header to=
 follow or a meta refresh tag in the returned HTML. Probing it from this =
plugin is wasted network traffic. =0A2. msn[.]com=0AThus far no evidence =
to suggest this domain hosts a redirector or is abusable. =0A3. Actual em=
ail from MailChimp=0AClick tracking link (302 redirect):=0Ahttps://redact=
ed[.]us21[.]list-manage[.]com/track/click?u=3D...=0A=0ATracking pixel (20=
0, harmless but wasted):=0Ahttps://us[.]list-manage[.]com/...=0A=0AUnsubs=
cribe link (200, wasted with potential side-effects)=0Ahttps://redacted.u=
s21[.]list-manage[.]com/unsubscribe?u=3D...=0AAll three URLs match a bare=
 .list-manage[.]com entry. So without the path element, it's impossible t=
o probe the redirect without probing the other two. You could say that th=
e risk of side-effects is small because it's a HEAD request, but if someo=
ne enables url_redirector_use_selenium, every probe turns into a full GET=
 with JavaScript execution. =0AHappy to revisit any of these specific poi=
nts if you have further ideas. Perhaps we could add back some but not all=
?=0AThanks=0AKent=0AOn Tue, May 19, 2026 at 04:07 PM, [email protected] =
wrote:=0AOn 5/19/26 6:24 PM, Kent Oyer wrote:=0AThat was sort of intentio=
nal. I feel that probing every URL from bing.com, msn.com, and google.com=
 just to see if it's a redirector is wasteful and potentially dangerous.=
=0Aat least google[.]com/search is abused and other urls as well, listing=
 all of them might be a very long task.=0A=0AThe other domains (list-mana=
ge.com, etc.) are less dangerous, but you still run the risk of hitting u=
nsubscribe links and tracking pixels. The only "safe" way to probe them i=
s if the path matches a known redirector pattern. I'm happy to discuss it=
 further if there is a better solution.=0Ano real solution for the moment=
, disabling most redirector's rules for many users is unexpected from a u=
ser's pov IMHO.=0A=0AP.S. I couldn't find any examples of a redirector UR=
L from msn.com. Are you aware of any?=0AI cannot find any atm but I bet t=
o have seen one.=0AThanks=0AGiovanni=0A=0AThanks=0AKent=0A=0AOn Tue, May =
19, 2026 at 02:53 AM, [email protected] (mailto:[email protected]) wrot=
e:=0A=0AOn 5/19/26 8:16 AM, [email protected] (mailto:[email protected]) =
<mailto:[email protected] (mailto:[email protected])> wrote:=0A=0AAuthor:=
 fkento=0ADate: Tue May 19 06:16:49 2026=0ANew Revision: 1934386=0A=0ALog=
:=0APrevent wasted HTTP traffic to non-redirect URLs=0A=0AI think this co=
mmit will disable redirector checks for some domains for all users that a=
re not running trunk.=0AWe need a `if !can(Mail::SpamAssassin::Plugin::Re=
directors::has_url_redirector_path)` to cover previous versions IMHO.=0AC=
heers=0AGiovanni=0A=0A* awstrack.me=0A* exactag.com=0A* cc.rs6.net=0A* ma=
ndrillapp.com=0A* list-manage.com=0A* bing.com=0A* msn.com=0A* msn.com.br=
=0A=0AModified:=0Aspamassassin/trunk/rules/25_url_redirectors.cf=0A=0AMod=
ified: spamassassin/trunk/rules/25_url_redirectors.cf=0A=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=0A--- spamassassin/trunk/rules/25_url_redirectors.cf   Tue May 19 06:=
12:45 2026   (r1934385)=0A+++ spamassassin/trunk/rules/25_url_redirectors=
.cf   Tue May 19 06:16:49 2026   (r1934386)=0A@@ -52,22 +52,16 @@ score R=
EDIR_URL_LOOP            0.01=0A=0Aurl_redirector .allaincemh.com=0Aurl_r=
edirector .australia4wdrentals.com=0A-url_redirector .awstrack.me=0Aurl_r=
edirector .benchurl.com=0Aurl_redirector .blob.core.windows.net=0A-url_re=
director .cc.rs6.net=0Aurl_redirector .ct.sendgrid.net=0A-url_redirector =
.exactag.com=0Aurl_redirector .hosted.phplist.com=0Aurl_redirector .href.=
li=0Aurl_redirector .maverickcrm.com=0A-url_redirector .msn.com=0A-url_re=
director .msn.com.br=0Aurl_redirector .yandex.net=0Aurl_redirector .yande=
x.ru=0Aurl_redirector auctiva.com=0Aurl_redirector awin1.com=0A-url_redir=
ector bing.com=0Aurl_redirector cqbbs.cc=0Aurl_redirector cdn.dragon.cere=
.network=0Aurl_redirector channelchief.varindia.com=0A@@ -81,7 +75,6 @@ u=
rl_redirector link.sowl.to=0Aurl_redirector linklock.titanhq.com=0Aurl_re=
director links.e.shopmyexchange.com=0Aurl_redirector mccarthysearch.com=
=0A-url_redirector mandrillapp.com=0Aurl_redirector notifications.googlea=
pis.com=0Aurl_redirector post.spmailtechnolo.com=0Aurl_redirector secure-=
web.cisco.com=0A@@ -111,19 +104,12 @@ url_redirector_get t.nypost.com=0Au=
rl_redirector_get track.pstmrk.it=0A=0Aif can(Mail::SpamAssassin::Plugin:=
:Redirectors::has_url_redirector_path)=0A-    clear_url_redirector .awstr=
ack.me=0Aurl_redirector .awstrack.me/L0/=0A-=0A-    clear_url_redirector =
.exactag.com=0Aurl_redirector .exactag.com/cl.aspx=0A-=0A-    clear_url_r=
edirector .cc.rs6.net=0Aurl_redirector .cc.rs6.net/tn.jsp=0A-=0A-    clea=
r_url_redirector mandrillapp.com=0Aurl_redirector mandrillapp.com/track/c=
lick=0A-=0Aurl_redirector .list-manage.com/track/click=0A+    url_redirec=
tor bing.com/ck/a=0Aurl_redirector substack.com/redirect/=0Aurl_redirecto=
r go.pardot.com/e/

------=_Part_262_627670374.1779264920
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html><head><meta http-equiv=3D"Content-Type" content=3D"t=
ext/html; charset=3Dutf-8" /></head><body><div data-crea=3D"font-wrapper"=
 style=3D"font-family: Tahoma, sans-serif; font-size: 16px; direction: lt=
r"><div style=3D"font-family: Tahoma; font-size: 16px"></div><div><div da=
ta-crea=3D"font-wrapper" style=3D"font-family: Tahoma, sans-serif; font-s=
ize: 16px; direction: ltr"><div>Hi Giovanni,</div><div><br></div><div>You=
 make a fair point about this being an unexpected change for users runnin=
g 4.0.2 pre-1934332. After a bit of pondering, I have two responses/conce=
rns (both IMHO):</div><div><br></div><div>1. Probing URLs we haven't vett=
ed is risky and equally unexpected. If SA's probe ends up unsubscribing a=
 user from a list,=0A or approving/denying a request on their behalf, tha=
t's a far worse =0Asurprise than a missing redirector match.=C2=A0An argu=
ment could even be made that a lenient allowlist is itself an =0Aattack s=
urface. A crafted spam message can direct SA to fire HTTP =0Arequests at =
attacker-chosen URLs on any allowlisted host, from the =0Arecipient's mai=
l-server IP. The narrower the allowlist, the smaller the =0Arisk.</div><d=
iv><br></div><div>2. The .cf file is a curated allowlist, not part of the=
 API. I think users expect us to maintain it as we learn more about which=
 hosts are abusable and how they operate. Pruning entries that don't meet=
 the standard for inclusion is part of that maintenance. For instance, th=
e documentation in the .cf file states:<div><br></div><div># Please only =
add entries that you manually verified as actual working<br># redirectors=
 that can have abusable custom URLs.=C2=A0 Adding non-abusable<br># servi=
ces only generates unnecessary HTTP requests.</div><div><br></div><div>So=
 the criteria for inclusion are: (1) actual working redirector and =0A(2)=
 from an abusable service. Including hosts that may-or-may-not be =0Awork=
ing redirectors seems contrary to that advice.</div></div><div><br></div>=
<div>Here are a few examples for discussion:</div><div><br></div><div>1. =
google[.]com/search</div><div><br></div><div>It may be abused, but it's n=
ot a redirector. It returns a 200 response along with a search results pa=
ge. There's no Location header to follow or a meta refresh tag in the ret=
urned HTML. Probing it from this plugin is wasted network traffic.=C2=A0<=
/div><div><br></div><div>2. msn[.]com</div><div><br></div><div>Thus far n=
o evidence to suggest this domain hosts a redirector or is abusable.=C2=
=A0</div><div><br></div><div>3. Actual email from MailChimp</div><div><br=
></div><div><div>Click tracking link (302 redirect):<br>https://redacted[=
.]us21[.]list-manage[.]com/track/click?u=3D...<br><br>Tracking pixel (200=
, harmless but wasted):<br>https://us[.]list-manage[.]com/...<br><br>Unsu=
bscribe link (200, wasted with potential side-effects)<br>https://redacte=
d.us21[.]list-manage[.]com/unsubscribe?u=3D...<br><br></div><div>All=0A t=
hree URLs match a bare .list-manage[.]com entry. So without the path =0Ae=
lement, it's impossible to probe the redirect without probing the other=
=0A two. You could say that the risk of side-effects is small because it'=
s a=0A HEAD request, but if someone enables url_redirector_use_selenium, =
every=0A probe turns into a full GET with JavaScript execution.=C2=A0</di=
v><div><br></div><div>Happy to revisit any of these specific points if yo=
u have further ideas. Perhaps we could add back some but not all?</div><d=
iv><br></div><div>Thanks</div><div>Kent</div><br></div>On Tue, May 19, 20=
26 at 04:07 PM, [email protected] wrote:</div></div><blockquote><div>On =
5/19/26 6:24 PM, Kent Oyer wrote:<br><blockquote>That was sort of intenti=
onal. I feel that probing every URL from bing.com, msn.com, and google.co=
m just to see if it's a redirector is wasteful and potentially dangerous.=
</blockquote><br>at least google[.]com/search is abused and other urls as=
 well, listing all of them might be a very long task.<br><br><blockquote>=
The other domains (list-manage.com, etc.) are less dangerous, but you sti=
ll run the risk of hitting unsubscribe links and tracking pixels. The onl=
y "safe" way to probe them is if the path matches a known redirector patt=
ern. I'm happy to discuss it further if there is a better solution.</bloc=
kquote><br>no real solution for the moment, disabling most redirector's r=
ules for many users is unexpected from a user's pov IMHO.<br><br><blockqu=
ote>P.S. I couldn't find any examples of a redirector URL from msn.com. A=
re you aware of any?</blockquote><br>I cannot find any atm but I bet to h=
ave seen one.<br>Thanks<br>Giovanni<br><br><blockquote>Thanks<br>Kent<br>=
<br>On Tue, May 19, 2026 at 02:53 AM, <a target=3D"_blank" href=3D"mailto=
:[email protected]" class=3D"external">[email protected]</a> wrote:<br>=
<br>On 5/19/26 8:16 AM, <a target=3D"_blank" href=3D"mailto:fkento@apache=
.org" class=3D"external">[email protected]</a> &lt;mailto:<a target=3D"_b=
lank" href=3D"mailto:[email protected]" class=3D"external">fkento@apache.=
org</a>&gt; wrote:<br><br>Author: fkento<br>Date: Tue May 19 06:16:49 202=
6<br>New Revision: 1934386<br><br>Log:<br>Prevent wasted HTTP traffic to =
non-redirect URLs<br><br>I think this commit will disable redirector chec=
ks for some domains for all users that are not running trunk.<br>We need =
a `if !can(Mail::SpamAssassin::Plugin::Redirectors::has_url_redirector_pa=
th)` to cover previous versions IMHO.<br>Cheers<br>Giovanni<br><br>* awst=
rack.me<br>* exactag.com<br>* cc.rs6.net<br>* mandrillapp.com<br>* list-m=
anage.com<br>* bing.com<br>* msn.com<br>* msn.com.br<br><br>Modified:<br>=
spamassassin/trunk/rules/25_url_redirectors.cf<br><br>Modified: spamassas=
sin/trunk/rules/25_url_redirectors.cf<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>--- spama=
ssassin/trunk/rules/25_url_redirectors.cf=C2=A0=C2=A0=C2=A0Tue May 19 06:=
12:45 2026=C2=A0=C2=A0=C2=A0(r1934385)<br>+++ spamassassin/trunk/rules/25=
_url_redirectors.cf=C2=A0=C2=A0=C2=A0Tue May 19 06:16:49 2026=C2=A0=C2=A0=
=C2=A0(r1934386)<br>@@ -52,22 +52,16 @@ score REDIR_URL_LOOP=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A00.01<br><br>u=
rl_redirector .allaincemh.com<br>url_redirector .australia4wdrentals.com<=
br>-url_redirector .awstrack.me<br>url_redirector .benchurl.com<br>url_re=
director .blob.core.windows.net<br>-url_redirector .cc.rs6.net<br>url_red=
irector .ct.sendgrid.net<br>-url_redirector .exactag.com<br>url_redirecto=
r .hosted.phplist.com<br>url_redirector .href.li<br>url_redirector .maver=
ickcrm.com<br>-url_redirector .msn.com<br>-url_redirector .msn.com.br<br>=
url_redirector .yandex.net<br>url_redirector .yandex.ru<br>url_redirector=
 auctiva.com<br>url_redirector awin1.com<br>-url_redirector bing.com<br>u=
rl_redirector cqbbs.cc<br>url_redirector cdn.dragon.cere.network<br>url_r=
edirector channelchief.varindia.com<br>@@ -81,7 +75,6 @@ url_redirector l=
ink.sowl.to<br>url_redirector linklock.titanhq.com<br>url_redirector link=
s.e.shopmyexchange.com<br>url_redirector mccarthysearch.com<br>-url_redir=
ector mandrillapp.com<br>url_redirector notifications.googleapis.com<br>u=
rl_redirector post.spmailtechnolo.com<br>url_redirector secure-web.cisco.=
com<br>@@ -111,19 +104,12 @@ url_redirector_get t.nypost.com<br>url_redir=
ector_get track.pstmrk.it<br><br>if can(Mail::SpamAssassin::Plugin::Redir=
ectors::has_url_redirector_path)<br>-=C2=A0=C2=A0=C2=A0=C2=A0clear_url_re=
director .awstrack.me<br>url_redirector .awstrack.me/L0/<br>-<br>-=C2=A0=
=C2=A0=C2=A0=C2=A0clear_url_redirector .exactag.com<br>url_redirector .ex=
actag.com/cl.aspx<br>-<br>-=C2=A0=C2=A0=C2=A0=C2=A0clear_url_redirector .=
cc.rs6.net<br>url_redirector .cc.rs6.net/tn.jsp<br>-<br>-=C2=A0=C2=A0=C2=
=A0=C2=A0clear_url_redirector mandrillapp.com<br>url_redirector mandrilla=
pp.com/track/click<br>-<br>url_redirector .list-manage.com/track/click<br=
>+=C2=A0=C2=A0=C2=A0=C2=A0url_redirector bing.com/ck/a<br>url_redirector =
substack.com/redirect/<br>url_redirector go.pardot.com/e/</blockquote></d=
iv></blockquote></div></body></html>

------=_Part_262_627670374.1779264920--