mixandClaude Opus 5.5
4dd46ea355
Security review of the DMARC report path (Fable, 2026-10-11), which ran for the first time in 2.0.0. No Critical or High finding. Fixed: - Medium: a report was bounded only as 8 MiB of XML - some 160 000 records or one name of megabytes, all of it rows and table cells. At most 5 000 records (more is ErrRejected, dropped), text fields cut to 255 bytes on a character boundary, a record's count capped. - Medium: the cap of 500 reports was for the whole server, so a stranger filing under one domain's address evicted every other domain's reports. PruneDMARCReports counts per domain. - Low: the pipe service ran up to default_process_limit (100) commands at once against the panel's database; maxproc is 1. - Low: the reason logged for a dropped message carried the sender's bytes (header line, zip entry name) as they came; cut to 200 bytes and reduced to printable ASCII, zip entry names quoted. - Low: SELFPOST_DATA_DIR / SELFPOST_DB_PATH with whitespace or "$" would reach the command through export_environment as another path; refused at start when DMARC ingest is on. Left as they are, told to the owner: the parse-failure count is a lifetime figure shown under "This week"; a report larger than the command reads is dropped as unreadable; nested multipart is not searched. The hub's Retention line follows the design commit before this one. security.md: the review, and the accepted-risk entry says what a stranger can and cannot do now. The roadmap no longer calls the review pending. go vet ./cmd/... ./internal/dmarc/ ./internal/store/: ok go test ./cmd/... ./internal/dmarc/ ./internal/store/ ./internal/web/...: ok make e2e on the test server (with the port-25 scenarios of the next commit): ok Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
109 lines
3.1 KiB
Go
109 lines
3.1 KiB
Go
package store
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestDMARCReportRoundTrip(t *testing.T) {
|
|
st, err := Open(t.TempDir() + "/test.db")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer st.Close()
|
|
|
|
now := time.Now().UTC().Truncate(time.Second)
|
|
_, err = st.InsertDMARCReport(DMARCReport{
|
|
Domain: "example.com",
|
|
Reporter: "google.com",
|
|
ReportID: "abc",
|
|
PeriodBegin: now.Add(-24 * time.Hour),
|
|
PeriodEnd: now,
|
|
ReceivedAt: now,
|
|
PassCount: 5,
|
|
FailCount: 1,
|
|
Records: []DMARCReportRecord{{
|
|
SourceIP: "203.0.113.1", Count: 5, SPFResult: "pass", DKIMResult: "pass",
|
|
}},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
list, err := st.ListDMARCReports(DMARCReportScope{Domains: []string{"example.com"}}, 10)
|
|
if err != nil || len(list) != 1 {
|
|
t.Fatalf("list: %v err=%v", list, err)
|
|
}
|
|
got, err := st.GetDMARCReport(list[0].ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got.PassCount != 5 || len(got.Records) != 1 {
|
|
t.Fatalf("got %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestPruneDMARCReports(t *testing.T) {
|
|
st, err := Open(t.TempDir() + "/test.db")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer st.Close()
|
|
|
|
old := time.Now().UTC().AddDate(0, 0, -120)
|
|
for i := 0; i < 3; i++ {
|
|
if _, err := st.InsertDMARCReport(DMARCReport{
|
|
Domain: "example.com", Reporter: "r", ReportID: string(rune('a' + i)),
|
|
PeriodBegin: old, PeriodEnd: old, ReceivedAt: old,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err := st.PruneDMARCReports("example.com"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
list, _ := st.ListDMARCReports(DMARCReportScope{AllDomains: true}, 100)
|
|
if len(list) != 0 {
|
|
t.Fatalf("expected prune by age, got %d", len(list))
|
|
}
|
|
}
|
|
|
|
// The domains a list is limited to are the whole answer: an empty list is a
|
|
// viewer who reaches nothing, never a viewer who reaches everything.
|
|
func TestListDMARCReportsEmptyListIsNoRows(t *testing.T) {
|
|
st := openTestStore(t)
|
|
now := time.Now().UTC()
|
|
for _, domain := range []string{"a.example", "b.example"} {
|
|
if _, err := st.InsertDMARCReport(DMARCReport{
|
|
Domain: domain, Reporter: "r", ReportID: domain,
|
|
PeriodBegin: now.Add(-24 * time.Hour), PeriodEnd: now, ReceivedAt: now,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
for name, scope := range map[string]DMARCReportScope{
|
|
"an empty list": {Domains: []string{}},
|
|
"no scope at all": {},
|
|
} {
|
|
list, err := st.ListDMARCReports(scope, 10)
|
|
if err != nil {
|
|
t.Fatalf("%s is an error: %v", name, err)
|
|
}
|
|
if len(list) != 0 {
|
|
t.Errorf("%s returned %d report(s), want none", name, len(list))
|
|
}
|
|
}
|
|
list, err := st.ListDMARCReports(DMARCReportScope{Domains: []string{"a.example"}}, 10)
|
|
if err != nil || len(list) != 1 || list[0].Domain != "a.example" {
|
|
t.Errorf("one domain = %+v, %v; want only a.example", list, err)
|
|
}
|
|
list, err = st.ListDMARCReports(DMARCReportScope{AllDomains: true}, 10)
|
|
if err != nil || len(list) != 2 {
|
|
t.Errorf("all domains = %d report(s), %v; want both", len(list), err)
|
|
}
|
|
list, err = st.ListDMARCReports(DMARCReportScope{AllDomains: true, Domains: []string{"a.example"}}, 10)
|
|
if err != nil || len(list) != 2 {
|
|
t.Errorf("all domains with a list = %d report(s), %v; want both (AllDomains wins)", len(list), err)
|
|
}
|
|
}
|