mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

findings of the security review of stage 1

Browse Source 
The review of d254a99..fd29468 (read-only, a separate agent) found all
five fixes sound and nothing above low. Fixed here:

- The M1 e2e step passed on the unfixed code: the stranger's RSET between
  MAIL FROMs ends the transaction, Postfix's mail_reset() calls
  milter_abort(), and the old code released the slot too. The stranger now
  keeps one MAIL FROM open (strangerHoldsMailFrom) while the domain's own
  application sends; under the old code that slot was the domain's one.
- A domain import could still store a report address on the server's own
  name (W1's form rule only): checkDomainImport refuses one that is not
  the domain's own hosted address. Not a mailbox either way, but the
  panel would show an address the server refuses. Cases in
  TestDomainImportIsCheckedLikeTheForms.
- DeleteDomain matches the reports' domain without regard to case.
- A cut that fails after the journal rows were written says the rows were
  written.
- dmarc.Service.Resync and inbound.Service.Resync are serialised like
  app.Service.Resync (W3's shape, outside its diff).

Left as the review's nit: three ApplicationByLogin lookups for a refused
MAIL FROM (a refusal is rare; the store is local).

go test ./internal/dmarc ./internal/inbound ./internal/store; the import
test; GOOS=linux go vet ./test/e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 22:13:36 +03:00
co-authored by Claude Opus 5.5
parent 3a8e19b71c
commit 4433688500
7 changed files with 61 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/handlers/handlers_import_test.go
+11
View File
@@ -38,6 +38,12 @@ func TestDomainImportIsCheckedLikeTheForms(t *testing.T) {
if msg := h.checkDomainImport(&exp); msg != "" {
t.Fatalf("a good export refused: %s", msg)
}
// The domain's own hosted address is its own.
own := good()
own.DMARCRua = "dmarc-reports+example.com@mail.example.org"
if msg := h.checkDomainImport(&own); msg != "" {
t.Fatalf("the domain's own hosted address refused: %s", msg)
}
if got := strings.Join(exp.Applications[0].AuthAllowedIPs, " "); got != "192.0.2.1 2001:db8::1" {
t.Errorf("client addresses stored as %q, want as the form stores them", got)
}
@@ -64,6 +70,11 @@ func TestDomainImportIsCheckedLikeTheForms(t *testing.T) {
"Invalid DKIM selector in export file: selector must be at most 63 characters"},
{"report address", func(e *domain.DomainExport) { e.DMARCRua = "not an address" },
"Invalid report address in export file: "},
// As on Domain settings (security audit 2026-10-17, W1).
{"report address on the hostname", func(e *domain.DomainExport) { e.DMARCRua = "ops@MAIL.example.org" },
"The export's report address is on this server's own name"},
{"another domain's hosted address", func(e *domain.DomainExport) { e.DMARCRua = "dmarc-reports+victim.example@mail.example.org" },
"The export's report address is on this server's own name"},
{"no window", func(e *domain.DomainExport) { e.RateLimit.WindowSeconds = 0 },
"Invalid rate limit for the domain in export file: enter a time window greater than zero seconds"},
{"no messages", func(e *domain.DomainExport) { e.RateLimit.MaxMessages = 0 },