]> git.ipfire.org Git - thirdparty/rspamd.git/commit
[Fix] Forged recipients: compare addresses as they were transmitted
authorVsevolod Stakhov <vsevolod@rspamd.com>
Thu, 16 Jul 2026 09:47:27 +0000 (10:47 +0100)
committerVsevolod Stakhov <vsevolod@rspamd.com>
Thu, 16 Jul 2026 09:47:27 +0000 (10:47 +0100)
commitf5d7db89db756deb986cd72329100d0614957e9e
tree113b849a959e213951e30b40141fe95f27af256c
parentba9262916ba82f54c6c189a00c7c1f3b5d62d7e8
[Fix] Forged recipients: compare addresses as they were transmitted

The rule compared the rewritten envelope view against the wire MIME
headers, so a recipient alias mapping to another domain (legal for
recipients) could make a perfectly matching To header look forged.
Compare the envelope and the headers at the same altitude: both as they
were seen in the message, which is also what this rule checked before
alias rewriting was applied to tasks.

Issue: #6137
src/plugins/lua/forged_recipients.lua
test/functional/cases/001_merged/360_aliases.robot
test/functional/messages/aliases_rcpt_virtual.eml [new file with mode: 0644]