mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

dmarc: no custom report address on the server's own name (audit W1)

Browse Source 
Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 21:47:34 +03:00
co-authored by Claude Opus 5.5
parent c50314fb4c
commit 626bd337be
10 changed files with 91 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/handlers/handlers_dmarc.go
+8
View File
@@ -44,6 +44,14 @@ func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
refuse(http.StatusBadRequest, "Enter the report address or choose another option.")
return
}
// An address on the server's own name is a mailbox of this server:
// the one way to one is the hosted choice, which is tagged with this
// domain. A typed one opened an untagged mailbox - or another
// domain's - to the whole internet (security audit 2026-10-17, W1).
if dmarc.IsHostedOnHostname(email, h.cfg.Hostname) {
refuse(http.StatusBadRequest, "That address is on this server's own name. To have SelfPost receive the reports, choose SelfPost hosted.")
return
}
rua = email
case ruaHosted:
if h.dmarc == nil || !h.dmarc.Enabled() {