Skip to content

Mimeparser uses unprotected Date header #6641

Closed
@link2xt

Description

@link2xt

We already protect the Date header against modification here:

core/src/mimefactory.rs

Lines 914 to 936 in e5a3eae

} else if is_encrypted {
protected_headers.push(header.clone());
match header_name.as_str() {
"subject" => {
unprotected_headers.push((
"Subject",
mail_builder::headers::raw::Raw::new("[...]").into(),
));
}
"date"
| "in-reply-to"
| "references"
| "auto-submitted"
| "chat-version"
| "autocrypt-setup-message" => {
unprotected_headers.push(header.clone());
}
_ => {
// Other headers are removed from unprotected part.
}
}
} else {

There is an open PR #6649 to protect the Date by replacing it with unix epoch in the outer header.

However, it cannot be merged because mimeparser uses unprotected timestamp for Autocrypt header here:

core/src/mimeparser.rs

Lines 348 to 353 in 7f55613

if let Some(protected_aheader_value) = decrypted_mail
.headers
.get_header_value(HeaderDef::Autocrypt)
{
aheader_value = Some(protected_aheader_value);
}

I also made a minor fix for signed-only messages: #6642
Fix for the Autocrypt issue is at #6669

Metadata

Metadata

Assignees

Labels

bugSomething is not working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions