Skip to content

Conversation

martgil
Copy link
Collaborator

@martgil martgil commented Apr 21, 2025

This PR add an in-between detection before concluding that the detected noname file is a possible encryptedMsg.

close #5979


Tests (delete all except exactly one):

  • Tests added or updated

To be filled by reviewers

I have reviewed that this PR... (tick whichever items you personally focused on during this review):

  • addresses the issue it closes (if any)
  • code is readable and understandable
  • is accompanied with tests, or tests are not needed
  • is free of vulnerabilities
  • is documented clearly and usefully, or doesn't need documentation

@martgil martgil requested a review from sosnovsky as a code owner April 21, 2025 09:32
@martgil martgil marked this pull request as draft April 21, 2025 09:33
@martgil martgil marked this pull request as ready for review April 22, 2025 09:59
@martgil martgil marked this pull request as draft April 22, 2025 10:03
@martgil
Copy link
Collaborator Author

martgil commented Apr 22, 2025

We'd normally, wrote test for such PR but for such case, its a customer email and I cannot wrote such that specific test email with a "noname" file that has "application/pdf" type.

I think the most feasible and right way to do this is by splitting the test decrypt - an ambiguous file "noname" should not be recognized as an encrypted message and should be hidden in encrypted message into two, as the newer change should also fit for email const threadId1 = '18adb91ebf3ba7b9'; // email attachment "noname" with type img/<image-extension> and I believe it would not be part of that tests.

@martgil martgil marked this pull request as ready for review April 27, 2025 09:41
@martgil
Copy link
Collaborator Author

martgil commented Apr 27, 2025

Hi @sosnovsky - this one is ready for a review. Thank you.

@sosnovsky
Copy link
Collaborator

We'd normally, wrote test for such PR but for such case, its a customer email and I cannot wrote such that specific test email with a "noname" file that has "application/pdf" type.

It'll be useful to have such test, so in the future we won't break correct noname attachments parsing.
It should be possible to create such message with noname .pdf attachment by using Header Tools Lite extension for Thunderbird, it allows to edit message headers before sending.
Can you please try to create such message for test by removing name property from sending attachment?

@martgil
Copy link
Collaborator Author

martgil commented May 1, 2025

Hi @sosnovsky, I tried your suggestion and it works flawlessly by using https://addons.thunderbird.net/en-US/thunderbird/addon/header-tools-lite/?src=search. This tool definitely helps a lot.

@martgil
Copy link
Collaborator Author

martgil commented May 1, 2025

Hello @sosnovsky, I've added a test by crafting one. Please let me know if this looks good to you.

Copy link
Collaborator

@sosnovsky sosnovsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all good now, thanks!

@sosnovsky sosnovsky merged commit 370a7d7 into master May 2, 2025
12 checks passed
@sosnovsky sosnovsky deleted the issue-5979-better-detection-for-emails-with-noname-attachments branch May 2, 2025 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

HTML email with noname attachment mistakenly identified as encryptedMsg

2 participants