justreportit / thunderbird

Thunderbird plugin.
GNU General Public License v3.0
26 stars 3 forks source link

Addon should use Return-Path if available #22

Closed mss closed 2 years ago

mss commented 2 years ago

I looked into the source of the Thunderbird plugin. I assume that MessageHeader.author returns the value of the From header which might be (and often is) different than the actual SMTP envelope sender. A spam message should be reported to the domain of the actual sender, not the displayed sender (which is easy to forge). For most systems is recorded in the Return-Path.

I am no JavaScript developer but I think something like this should work:

browser.messageDisplayAction.onClicked.addListener((tab) =>{
  browser.messageDisplay.getDisplayedMessage(tab.id).then((message) => {
    browser.messages.getFull(message.id).then((parsed) => {
      browser.messages.getRaw(message.id).then((raw) => {
        browser.storage.local.get("mode").then((configuration) => {
          var sender = parsed.headers['Return-Path'][0] || message.author;
          var spamDomain = extractSpamDomain(sender);