griddler-mandrill 1.1.2 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 86dc4de8f452cac033829217d59a4c6bc9f773b9
-  data.tar.gz: dce4fb18f34941f751aba6f71a6de09088cdfa83
+  metadata.gz: 11fa381ea4f4b1865823cf93565cbbaa98ed5f40
+  data.tar.gz: f1810eaf5c1295420f384a2647371bf493b75d87
 SHA512:
-  metadata.gz: 9b6f95562127f589899a0074386cde554ca8ab3357698504fa633106a25bde17f7eb4743c9011a0ff92f5166fc4f78133b3dfeea6d4cf0218ec5348f6ddd8757
-  data.tar.gz: a42ada7733a4480f76f56cc3144632428d937ffdbb53558a0d3e5cdf02a4758166b5756a691bbe600bd9b10ccc829a74d7f1da6f3242012de73e9d0d429546da
+  metadata.gz: 41142c12a3bfc6034c850e3503424ea7c911bccd5c43d74875d2f955a8d0507059365f0824df0c8907d8c16f74336aef42050f584f8354016bf7bc25b73eff0a
+  data.tar.gz: 00d30dc2c0c3a05699df71924d75272871eee113f23d19afa575279c666195a9f33bea2503ead1a3fba471008473686a6e3021e4201c1eba0ab8561489e7e19c

data/CHANGELOG.md

@@ -1,5 +1,8 @@
 ## master
 
+## 1.1.3
+* Protect against SPF spoofing. #22 via [arunthampi](https://github.com/arunthampi)
+
 ## 1.1.2
 * Use Mandrill's `email` attribute to populate bcc if to and cc don't contain it. #19 and #20 via [Uelb](https://github.com/Uelb)
 

data/lib/griddler/mandrill/adapter.rb

@@ -11,7 +11,9 @@ module Griddler
       end
 
       def normalize_params
-        events.map do |event|
+        events.select do |event|
+          event[:spf].present? && (event[:spf][:result] == 'pass' || event[:spf][:result] == 'neutral')
+        end.map do |event|
           {
             to: recipients(:to, event),
             cc: recipients(:cc, event),

data/lib/griddler/mandrill/version.rb

@@ -1,5 +1,5 @@
 module Griddler
   module Mandrill
-    VERSION = '1.1.2'
+    VERSION = '1.1.3'
   end
 end

data/spec/griddler/mandrill/adapter_spec.rb

@@ -104,6 +104,45 @@ describe Griddler::Mandrill::Adapter, '.normalize_params' do
     end
   end
 
+  describe 'when the spf record is softfail' do
+    before do
+      @params = params_hash
+      @params.first[:msg][:spf] = { result: 'softfail', detail: 'domain owner discourages use of this host' }
+    end
+
+    it "doesn't include emails that have failed the SPF test" do
+      params = default_params(@params)
+      normalized_params = Griddler::Mandrill::Adapter.normalize_params(params)
+      expect(normalized_params).to be_empty
+    end
+  end
+
+  describe 'when the spf record is fail' do
+    before do
+      @params = params_hash
+      @params.first[:msg][:spf] = { result: 'fail', detail: 'sender SPF fail' }
+    end
+
+    it "doesn't include emails that have failed the SPF test" do
+      params = default_params(@params)
+      normalized_params = Griddler::Mandrill::Adapter.normalize_params(params)
+      expect(normalized_params).to be_empty
+    end
+  end
+
+  describe 'when the spf record is neutral' do
+    before do
+      @params = params_hash
+      @params.first[:msg][:spf] = { result: 'neutral', detail: 'sender SPF neutral' }
+    end
+
+    it "does include emails that have the SPF result as 'neutral'" do
+      params = default_params(@params)
+      normalized_params = Griddler::Mandrill::Adapter.normalize_params(params)
+      expect(normalized_params.size).to eql 2
+    end
+  end
+
   describe 'when the email has no html part' do
     before do
       @params = params_hash

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: griddler-mandrill
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors:
 - Stafford Brunk
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-27 00:00:00.000000000 Z
+date: 2015-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: griddler