Message-ID should surely not be shown as a mailto: URL

On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

Hm, I wonder if sloppiness of this sort accounts for the remarkable
prevalence in my mail logs of spam-sign like this:

Jun 9 00:44:06 sss2 sm-mta[4062]: m594i5Ns004062: <19570.1142971720@sss.pgh.pa.us>... User unknown

Good bet.

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link. I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.

A

--
Andrew Sullivan
ajs@commandprompt.com
+1 503 667 4564 x104
http://www.commandprompt.com/

Andrew Sullivan wrote:

On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link. I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.

Mhonarc does this mangling. I tried to stop it but couldn't find the
way. I didn't investigate it too closely though, so most likely there
is a way to make it work. If anyone wants to spend some time on it,
feel free to send patches. Our resource files are here:

https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8

The actual mhonarc call is in this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc

The mhonarc documentation:
http://www.mhonarc.org/MHonArc/doc/mhonarc.html

Oh, FWIW, the Message-ID URLs (which are just hard links actually) are
created by this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/createmsgid.pl

It has a couple of holes (i.e. there are certain types of Message-Ids
for which it doesn't work), so patches are welcome too.

--
Alvaro Herrera http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.

Andrew Sullivan <ajs@commandprompt.com> writes:

On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link. I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.

What I'm complaining about is the logical disconnect involved in
sticking a mailto: onto an address that you have carefully made
unusable for sending mail to. I don't have a problem with munging
all of them, just leave off the mailto decoration.

regards, tom lane

Alvaro Herrera wrote:

Andrew Sullivan wrote:

On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link. I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.

Mhonarc does this mangling. I tried to stop it but couldn't find the
way. I didn't investigate it too closely though, so most likely there
is a way to make it work. If anyone wants to spend some time on it,
feel free to send patches. Our resource files are here:

https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8

The actual mhonarc call is in this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc

The mhonarc documentation:
http://www.mhonarc.org/MHonArc/doc/mhonarc.html

I looked at this for a while and am uncertain how to affect the header
display. When I was dealing with this, I considered the message-id to
be an identifier, rather than something I wanted displayed in the email
header block, so I put it above the header:

http://momjian.us/mhonarc/patches_hold/msg00021.html

Using these mhonarc.rc lines:

<MSGHEAD>
Message-ID: $MSGID$
</MSGHEAD>

You could even modify this to add a link to show the message by
message-id URL.

--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +

Alvaro Herrera wrote:

Andrew Sullivan wrote:

On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link. I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.

Mhonarc does this mangling. I tried to stop it but couldn't find the
way. I didn't investigate it too closely though, so most likely there
is a way to make it work. If anyone wants to spend some time on it,
feel free to send patches. Our resource files are here:

https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8

The actual mhonarc call is in this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc

The mhonarc documentation:
http://www.mhonarc.org/MHonArc/doc/mhonarc.html

Have you tried adding this to your mhonarc.rc file?

<NOMAILTO>

In fact looking at:

https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common

I see the use of MAILTO even though the comment doesn't match:

<!-- Don't convert e-mail addresses to mailto: URLs -->
25 <MAILTO>

It seems logical seeing as we are already using:

<SPAMMODE>

--
Bruce Momjian <bruce@momjian.us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +

Bruce Momjian wrote:

Have you tried adding this to your mhonarc.rc file?

<NOMAILTO>

Hmm, no, I just added it and the archive is being reprocessed. The
mailto: links have now been removed; for example see
http://archives.postgresql.org/pgsql-committers/2008-11/msg00111.php
(Mhonarc is still running)

I see the use of MAILTO even though the comment doesn't match:

<!-- Don't convert e-mail addresses to mailto: URLs -->
25 <MAILTO>

Ugh. I assume Marc took the original config file and switched the
setting without even looking at the comment.

--
Alvaro Herrera http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.

Okay, so Bruce got in Perl hacking mode today and wrote a script to
munge the message-ids. If you look at our archives you'll notice that
on each message the Message-Id header is now a proper link to the
message itself using the message-id-style URL, and it is no longer
munged by the "no spam" Mhonarc mode. (Well, actually it is, and it's
de-munged by Bruce's script later on. We'll be fixing that too
hopefully!)

Thanks Bruce!

--
Alvaro Herrera http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support