mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-28 15:02:28 +00:00
Alberto Bertogli
10aa1a55d0
We currently use the s= and d= tags as-is without any validation. They are used to construct the DNS name to look up the key, which is generally fine, but also the d= tag is used as-is in the Authentication-Results header. The latter can be used to inject malicious content, for example: d=example.com dkim=pass header.d=example.net can result in the header including: header.d=example.com dkim=pass header.d=example.net regardless of the validation status. To fix that problem, this patch now validates the domain (using the same normalization we use in other areas, like RCPT TO and MAIL FROM) on both tags. If any of the tags have invalid domains, we consider the signature invalid as per RFC 6376 section 3.5.