Calendar Spam addressees turn up in "Recently contacted"

[dschuessler]

Describe the bug

If you are an addressee of calendar spam and import a calendar with such spam into Nextcloud, the other adressees turn up in the contacts app under "Recently contacted" although they have not been recently contacted.

Steps to reproduce

1. Have an iCloud account with calendar data containing old calendar spam.

   

2. Export this calendar data to .ics files via macOS calendar.

3. Connect macOS calendar to Nextcloud as described here.

4. Import the .ics files into the Nextcloud calendar via macOS calendar.

5. Open the contacts app.

Expected behavior

The addressees of the calendar spam do not appear under "Recently contacted" because they have not been recently contacted.

Actual behavior

The addressees of the calendar spam do appear under "Recently contacted".

Contact version

6.2.0

Operating system

Raspberry Pi OS Lite (64-bit, Debian Bullseye)

PHP engine version

PHP 7.4

Web server

Other

Database

PostgreSQL

Additional info

I thought my account had been breached and spent an evening on figuring out how someone could have contacted these people through my Nextcloud account. Only once I dumped my database to find where the addresses have been persisted could I draw the connection to the calendar data.

If someone gets here via Google because mysterious email addresses allegedly have been recently contacted by you, check your calendar data for calendar spam.

[ChristophWurst]

https://github.com/nextcloud/server/blob/master/apps/dav/lib/Listener/CalendarContactInteractionListener.php handles the interactions. Events created or updated cause interactions to be tracked for recently contacted.

Import the .ics files into the Nextcloud calendar via macOS calendar

This is why it happens.

What would you suggest Nextcloud to do differently to handle this scenario?

[ChristophWurst]

cc @kesselb

[szaimen]

Hi, which NC version?

[dschuessler]

@szaimen 25.0.6

[dschuessler]

@ChristophWurst I think Nextcloud should not assume that the mere appearance of an email address in a calendar means that the user has recently contacted this person. I can think of several cases where this assumption does not hold.

• You have been legitimately invited to an event/meeting, but have not contacted other addressees or the organizer.
• You import legitimate invites that are way in the past and are thus not recent contacts.
• You have been spammed like me.

I don't know the use case for the "Recently contacted" section. If you briefly explain it, I might be able to give more constructive feedback.

[ChristophWurst]

We could restructure the event parser so that only attendees of events are added when the user is the organizer. Then they did interact with that person.

But if you are just invited you didn't necessarily interact with the other person. That's true.

The idea of the feature is that any interaction is tracked and can then be imported into a user's person address book.

[dschuessler]

Your proposal sounds like a proper fix to me.

However, if the use case of the feature is to track any interaction of the user with other people, regardless of recency, maybe the feature should not be called "Recently contacted" in the UI but rather something along the lines of "Contacted by you". (Normally, I'd offer a PR, in case you agree, but I'm not sure about your localization workflow.)

[ChristophWurst]

@jancborchardt @marcoambrosini @nimishavijay what do you think about the refined name for Recently contacted?

[jancborchardt]

@ChristophWurst I prefer your proposal for adjusting the functionality as per https://github.com/nextcloud/server/issues/38390#issuecomment-1557425506

The idea of "recently contacted" is also that eventually you either add these people to your proper contacts, or they are only relevant for a short time.

[ChristophWurst]

https://github.com/nextcloud/server/pull/38542