From 57c29c14a40fa336687dc416b878c074c1119f53 Mon Sep 17 00:00:00 2001 From: link2xt Date: Tue, 11 Jun 2024 21:57:58 +0000 Subject: [PATCH] Reject DKIM signatures that do not cover the whole message body --- CHANGELOG.md | 3 +++ cmdeploy/src/cmdeploy/opendkim/final.lua | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2423fd7f..2dfd2877 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## untagged +- Reject DKIM signatures that do not cover the whole message body. + ([#321](https://github.com/deltachat/chatmail/pull/321)) + - check that OpenPGP has only PKESK, SKESK and SEIPD packets ([#323](https://github.com/deltachat/chatmail/pull/323), [#324](https://github.com/deltachat/chatmail/pull/324)) diff --git a/cmdeploy/src/cmdeploy/opendkim/final.lua b/cmdeploy/src/cmdeploy/opendkim/final.lua index 133f7784..3b8858e5 100644 --- a/cmdeploy/src/cmdeploy/opendkim/final.lua +++ b/cmdeploy/src/cmdeploy/opendkim/final.lua @@ -19,7 +19,11 @@ for i = 1, nsigs do -- Any valid signature that was not ignored like this -- means the message is acceptable. if sigres == 0 then - return nil + -- Do not accept the signature if it does not cover the whole body + -- of the message by using `l=` tag. + if odkim.sig_canonlength(ctx, sig) < odkim.sig_bodylength(ctx, sig) then + return nil + end end end