mixandClaude Opus 5.5
626bd337be
Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.
Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.
Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.
Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.9 KiB
Go
54 lines
1.9 KiB
Go
package dmarc
|
|
|
|
import (
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// The ingest allow-list is the report address of each domain that points at
|
|
// this host, and nothing for the server as a whole: a new domain (no reports) and a domain
|
|
// reporting to another host open nothing of their own.
|
|
func TestAllowedRecipientsFollowTheDomainAddresses(t *testing.T) {
|
|
st, err := store.Open(t.TempDir() + "/test.db")
|
|
if err != nil {
|
|
t.Fatalf("Open: %v", err)
|
|
}
|
|
defer st.Close()
|
|
hosted, _ := st.AddDomain("hosted.example", "sel")
|
|
typed, _ := st.AddDomain("typed.example", "sel")
|
|
if _, err := st.AddDomain("silent.example", "sel"); err != nil {
|
|
t.Fatalf("AddDomain: %v", err)
|
|
}
|
|
local, _ := st.AddDomain("local.example", "sel")
|
|
if err := st.SetDomainDMARCAddress(hosted.ID, HostedReportAddress("mail.example.com", "hosted.example")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := st.SetDomainDMARCAddress(typed.ID, "reports@elsewhere.example"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := st.SetDomainDMARCAddress(local.ID, "ops@mail.example.com"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
// Another domain's hosted address, stored for this one: no mailbox
|
|
// either (W1's second shape).
|
|
stolen, _ := st.AddDomain("stolen.example", "sel")
|
|
if err := st.SetDomainDMARCAddress(stolen.ID, HostedReportAddress("mail.example.com", "victim.example")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
got, err := NewService(st, nil, "mail.example.com", true).AllowedRecipients()
|
|
if err != nil {
|
|
t.Fatalf("AllowedRecipients: %v", err)
|
|
}
|
|
// Only the hosted address of the domain that chose it: an address typed
|
|
// on the server's name (ops@) opens nothing (security audit 2026-10-17,
|
|
// W1; this test asserted the opposite until then).
|
|
want := []string{"dmarc-reports+hosted.example@mail.example.com"}
|
|
if !reflect.DeepEqual(got, want) {
|
|
t.Errorf("allowed recipients = %v, want %v", got, want)
|
|
}
|
|
}
|