reports: Obfuscate names when sending them over email

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/dbl/__init__.py b/src/dbl/__init__.py
index 446a29ab25a472f0da0ee58671de23f71382eab6..40ad9ede7a03e73ef41662e8879e62d6be8ccab1 100644 (file)
--- a/src/dbl/__init__.py
+++ b/src/dbl/__init__.py
@@ -94,6 +94,26 @@ class Backend(object):
                """
                return publicsuffix2.PublicSuffixList()
 
+       def obfuscate_name(self, name):
+               """
+                       Takes a name and obfuscates it so it can be sent over email
+               """
+               if name is None:
+                       return None
+
+               # Find the TLD
+               tld = self.psl.get_tld(name, strict=True)
+
+               # If we cannot identify the TLD, we cannot continue
+               if not tld:
+                       return name
+
+               # Remove the suffix
+               name = name.removesuffix(".%s" % tld)
+
+               # Put everything back together again
+               return "%s[.]%s" % (name, tld)
+
        @functools.cached_property
        def auth(self):
                return auth.Auth(self)

diff --git a/src/dbl/reports.py b/src/dbl/reports.py
index 1fa3ac9c546306fbf3c099e62a8c9f53c6a6179e..6063528eae664594309a82330359eae3cd351a17 100644 (file)
--- a/src/dbl/reports.py
+++ b/src/dbl/reports.py
@@ -134,10 +134,13 @@ class Reports(object):
 
                                # List all reports
                                for report in sorted(lists[list]):
+                                       # Obfuscate the name
+                                       name = self.backend.obfuscate_name(report.name)
+
                                        if report.block:
-                                               headline = _("%s should be blocked") % report.name
+                                               headline = _("%s should be blocked") % name
                                        else:
-                                               headline = _("%s should be allowed") % report.name
+                                               headline = _("%s should be allowed") % name
 
                                        # Add the headline
                                        lines.append("  * %s" % headline)
@@ -289,13 +292,16 @@ class Report(sqlmodel.SQLModel, database.BackendMixin, table=True):
                if not reporter:
                        return
 
+               # Obfuscate the name
+               name = self.backend.obfuscate_name(self.name)
+
                # Compose the body
                lines = (
                        _("Hello,"),
                        "",
                        _("Thank you for submitting a report to the IPFire DBL service."),
                        "",
-                       _("We have received your report regarding %s and wanted to confirm that it's now in our moderation queue.") % self.name,
+                       _("We have received your report regarding %s and wanted to confirm that it's now in our moderation queue.") % name,
                        "",
                        _("Our moderation team will carefully review your submission and you'll receive an update via email"
                                " once a decision has been made. Please note that review times may vary depending on the volume of reports we receive."),
@@ -330,14 +336,17 @@ class Report(sqlmodel.SQLModel, database.BackendMixin, table=True):
                if not sender:
                        raise RuntimeError("Failed to fetch the sender '%s'" % self.closed_by)
 
+               # Obfuscate the name
+               name = self.backend.obfuscate_name(self.name)
+
                # ACCEPTED
                if self.accepted:
-                       subject = "[IPFire DBL] %s" % (_("Your report for %s has been accepted") % self.name)
+                       subject = "[IPFire DBL] %s" % (_("Your report for %s has been accepted") % name)
 
                        lines = (
                                _("Hello,"),
                                "",
-                               _("Thank you for taking the time to report %s to our IPFire DBL service.") % self.name,
+                               _("Thank you for taking the time to report %s to our IPFire DBL service.") % name,
                                "",
                                _("We've reviewed your submission and are pleased to inform you that your report has been ACCEPTED."
                                        " The domain has been added to our blocklist and will now be flagged by systems using our service."),
@@ -353,12 +362,12 @@ class Report(sqlmodel.SQLModel, database.BackendMixin, table=True):
 
                # DECLINED
                else:
-                       subject = "[IPFire DBL] %s" % (_("Your report for %s has been reviewed") % self.name)
+                       subject = "[IPFire DBL] %s" % (_("Your report for %s has been reviewed") % name)
 
                        lines = (
                                _("Hello,"),
                                "",
-                               _("Thank you for taking the time to report %s to our IPFire DBL service.") % self.name,
+                               _("Thank you for taking the time to report %s to our IPFire DBL service.") % name,
                                "",
                                _("We've carefully reviewed your submission."
                                        " After investigation, we've determined that this domain does not meet our criteria"