mixandClaude Opus 5.5
f1d90a2a1b
test / test (push) Waiting to run
The security documentation's last open item of panel-dkim-signing (the owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a session to a map of its own, emptied only on ABORT, and handed it to Headers - which no milter of the panel reads. Postfix bounds one header, not their number, so a message of nothing but headers up to the message size limit was held whole by the library in the sender check, the signer and the journal milter on 465/587 and in the inbound journal milter on port 25, where strangers send; the signer's 1 MiB refusal came after it was all in. third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause, LICENSE kept) with session.go changed: CodeHeader hands the header to Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md says what and why, and how to take a new upstream version. go.mod replaces the module with it; the Dockerfile copies third_party before "go mod download". TestTheLibraryKeepsNoHeaders holds it through the library's own client over two messages of one connection. Comments, security.md (the accepted risk becomes a note), development.md's library table, the plan and CHANGELOG follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
829 B
AMPL
27 lines
829 B
AMPL
module github.com/mixeme/selfpost
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/emersion/go-milter v0.4.1
|
|
github.com/emersion/go-msgauth v0.7.0
|
|
golang.org/x/crypto v0.58.0
|
|
modernc.org/sqlite v1.60.1
|
|
)
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/emersion/go-message v0.18.1 // indirect
|
|
github.com/google/uuid v1.6.0 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
golang.org/x/sys v0.49.0 // indirect
|
|
modernc.org/libc v1.77.1 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.12.1 // indirect
|
|
)
|
|
|
|
// go-milter with its header map dropped: third_party/go-milter/PATCHES.md.
|
|
replace github.com/emersion/go-milter => ./third_party/go-milter
|