search

MailScanner / v5

MailScanner v5
GNU General Public License v2.0
188 stars 60 forks source link

Phishing disarming is case sensitive. #577

Closed msapiro closed 2 years ago

msapiro commented 2 years ago

Links are disarmed if the domain in the URL is the same as the domain in the displayed text except for case. This should not be done.

example:

You can provide your updated contact information by visiting MailScanner has detected a possible fraud attempt from "www.zoomclassaction.com" claiming to be /www.ZoomClassAction.com/AddressUpdate

MailScanner 5.4.3-1

shawniverson commented 2 years ago

@msapiro Feel free to test #579 and see if this resolves this issue.

msapiro commented 2 years ago

@shawniverson Actually, it turns out this issue is not due to mixed case. The issue I reported is spurious. The disarming is not because the display text differs in case. It is because the display text has a leading slash, i.e. /www.ZoomClassAction.com/AddressUpdate. If the display text is www.ZoomClassAction.com/AddressUpdate without the leading slash, it is not disarmed with or without #579. Thus I think #579 is unnecessary although it probably doesn't break anything, and I'm closing this issue, as I think the current behavior is acceptable. Sorry for the noise.

shawniverson commented 2 years ago

@msapiro Good to know. I'm going to cancel the PR. I ran some tests with the unaltered code and and seems that case sensitivity is not an issue after all.