mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 9 Packages Projects Releases Wiki Activity

dmarc: no custom report address on the server's own name (audit W1)

Browse Source 
Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 21:47:34 +03:00
co-authored by Claude Opus 5.5
parent c50314fb4c
commit 626bd337be
10 changed files with 91 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/dmarc/service.go
+9 -6
View File
@@ -63,17 +63,20 @@ func (s *Service) AllowedRecipients() ([]string, error) {
seen[addr] = true
out = append(out, addr)
}
// Only what a domain has chosen is open: its report address opens the
// mailbox it names, if that is on this host. There is no mailbox for the
// server as a whole.
// Only what a domain has chosen is open, and only the one mailbox that is
// its own: the hosted address tagged with its name. A stored address on
// this host that is anything else - typed before 2.14.4, when the form
// still took one - opens nothing: it was an untagged mailbox, or another
// domain's, open to the internet (security audit 2026-10-17, W1). There
// is no mailbox for the server as a whole.
domains, err := s.store.ListDomains()
if err != nil {
return nil, err
}
for _, d := range domains {
// add keeps only addresses on this host, so a domain reporting elsewhere
// (or nowhere) opens nothing here.
add(d.DMARCRua)
if hosted := HostedReportAddress(s.hostname, d.Name); strings.EqualFold(strings.TrimSpace(d.DMARCRua), hosted) {
add(hosted)
}
}
sort.Strings(out)
return out, nil