mainSavannah Administration - Support: sr #110592, Privacy: Please don't include IP...

 
 

sr #110592: Privacy: Please don't include IP and UserAgent in email headers

Submitter:  consolatis
Submitted:  Sat 01 Jan 2022 04:53:04 AM UTC
   
 
Category:  Savannah mail server Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sat 22 Jan 2022 06:48:34 PM UTC, comment #7: 

Thanks for making that change removing User-Agent.  I think it makes a lot of sense.  It's an arbitrary untrusted user supplied data string.  Not propagating that seems like a good thing to me.

As to trying to hide email addresses...  I have always thought that was a questionable practice.  Email intrinsically uses addresses.  It is impossible to use an email without using an email address.  For people trying to keep it secret all it takes is ONE public posting anywhere and then the proverbial genie is out of the bottle and can never be put back in again.

Bob Proulx <rwp>
Site Administrator
Sat 22 Jan 2022 11:07:30 AM UTC, comment #6: 

Thank you :)

The other thing I just recognized is that all the recipients are listed within the To: header. Maybe the frontend could instead use BCC to make it impossible to harvest private mail addresses by just adding an own address to CC and then trigger a notification.

Although I understand that this may be done on purpose so recipients can talk to each other directly but in that case the mailer should likely use CC instead of TO.
It also clashes with the setting to hide the own mail address ('Hide email address from your account information').

consolatis
Sat 22 Jan 2022 10:40:21 AM UTC, comment #5: 

I've removed User-Agent and $_SERVER["REMOTE_ADDR"] from headers of notifications.

Ineiev <ineiev>
Site Administrator
Sun 02 Jan 2022 03:17:15 AM UTC, comment #4: 

I don't see a point in the whole "# User details." block.

If the savannah frontend has been used to create spam in the past it should be catched before actually sending the mail (limiting notifications for new users, denying them to add mail addresses to CC or similar).
Adding some kind of personal data identifiers from the sender so recipients can filter spam based on those seems somewhat backwards to me.

As a side note:
I don't remember if PHP allows \n in $_SERVER['HTTP_USER_AGENT'] but if yes everybody could inject their own mail headers into the notification mails and possibly replace the body by adding two \n in a row.

consolatis
Sun 02 Jan 2022 01:52:39 AM UTC, comment #3: 

Oh sorry.  I thought you were talking about the mailing list archives which log this.  For example this one from me.  Have no control over this.

https://lists.gnu.org/archive/html/savannah-users/2021-10/msg00006.html

I must admit I always thought displaying that in the mailing list archives seemed rather silly.  But many of those things were done due to problems with abuse and therefore things were added as an anti-abuse mechanism.  I can't think of any good use for the User-Agent though.  And of course it may be set to anything.  I consider it untrusted data from user input.

The Savannah web UI is Savane and that sending code is of course this.

https://git.savannah.gnu.org/cgit/administration/savane.git/tree/frontend/php/include/sendmail.php#n28

It mentions a "spamcheck" so this would need to be considered.  Therefore it is probably there as an anti-abuse measure.

I'll open the ticket again and see what the others think.  I am inclined to reduce the included information.  However I am swamped with other problems that are urgently calling for my attention.  Patches sent to savannah-hackers-public AT gnu.org for discussion are welcomed.

Bob Proulx <rwp>
Site Administrator
Sat 01 Jan 2022 07:09:48 AM UTC, comment #2: 

I am talking about the notification emails sent from savannah.gnu.org and savannah.nongnu.org.
Including the email just sent by this very comment and the email I got to notify me about your comment.

I should have mentioned that before. Sorry about that.

consolatis
Sat 01 Jan 2022 06:55:14 AM UTC, comment #1: 

The mailing lists are not a Savannah thing.

https://savannah.nongnu.org/maintenance/NotSavannahAdmins/

Therefore I can only close the ticket since there is nothing we can do about it here.

Please send an email to mailman AT gnu.org discuss Mailing list things.

Bob Proulx <rwp>
Site Administrator
Sat 01 Jan 2022 04:53:04 AM UTC, original submission:  

I don't see a point in doing that at all.

Headers:
- User-Agent
- X-Apparently-From

consolatis

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by consolatis (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-01-22 ineiev StatusNone Done
        Assigned toNone ineiev
        Open/ClosedOpen Closed
    2022-01-02 rwp StatusInvalid None
        Open/ClosedClosed Open
    2022-01-01 rwp StatusNone Invalid
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code