@remit/mailbox-service 0.0.53 → 0.0.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.53",
+  "version": "0.0.54",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/message-sync-address-spoof.test.ts

@@ -0,0 +1,306 @@
+/**
+ * Harvesting takes the display name straight off the envelope, and a sender
+ * chooses that string. A 2021 spam message reached this account's INBOX with
+ * `matthijs@ischen.nl <aramirez@secresaludguaviare.gov.co>`: the account's own
+ * address as the label on a stranger's. It was stored, autocomplete offered it
+ * back when the account holder typed his own address, and a private reply left
+ * the instance (issue #826).
+ *
+ * The name lands in three columns on this one save — the address book, the
+ * envelope the message header renders, and the sender label the message list
+ * shows and search indexes — so all three are asserted here.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type {
+	CreateAddressInput,
+	CreateEnvelopeAddressInput,
+	CreateThreadMessageInput,
+	IAddressRepository,
+	IEnvelopeRepository,
+	IMailboxRepository,
+	IMessageRepository,
+	IThreadMessageRepository,
+	MessageItem,
+	ThreadMessageItem,
+} from "@remit/data-ports";
+import type { ManagedConnectionFactory } from "./connection-factory.js";
+import { MessageSyncService } from "./message-sync.js";
+import type { ImapAddress, ImapEnvelope, ImapMessage } from "./types.js";
+
+const stub = <T>(): T => ({}) as T;
+
+const emptyEnvelope: ImapEnvelope = {
+	date: new Date(0).toISOString(),
+	messageId: "<root@example.com>",
+	subject: "Subject",
+	from: [],
+	sender: [],
+	replyTo: [],
+	to: [],
+	cc: [],
+	bcc: [],
+	inReplyTo: "",
+};
+
+interface Saved {
+	addresses: CreateAddressInput[];
+	envelopeAddresses: CreateEnvelopeAddressInput[];
+	threadMessages: CreateThreadMessageInput[];
+}
+
+/**
+ * Drive the real save path so the stored value is the one the write path
+ * produces, not one a test handed to a private method.
+ */
+const harvest = async (envelope: Partial<ImapEnvelope>): Promise<Saved> => {
+	const saved: Saved = {
+		addresses: [],
+		envelopeAddresses: [],
+		threadMessages: [],
+	};
+
+	const messageService = {
+		upsertWithStatus: async (input: unknown) => ({
+			item: input as MessageItem,
+			created: true,
+		}),
+	} as unknown as IMessageRepository;
+
+	const threadMessageService = {
+		create: async (input: CreateThreadMessageInput) => {
+			saved.threadMessages.push(input);
+			return input as unknown as ThreadMessageItem;
+		},
+	} as unknown as IThreadMessageRepository;
+
+	const envelopeService = {
+		upsertEnvelope: async () => {},
+		upsertBodyParts: async () => {},
+	} as unknown as IEnvelopeRepository;
+
+	const addressService = {
+		upsertAddress: async (input: CreateAddressInput) => {
+			saved.addresses.push(input);
+		},
+		upsertEnvelopeAddress: async (input: CreateEnvelopeAddressInput) => {
+			saved.envelopeAddresses.push(input);
+		},
+	} as unknown as IAddressRepository;
+
+	const service = new MessageSyncService(
+		stub<ManagedConnectionFactory>(),
+		stub<IMailboxRepository>(),
+		messageService,
+		envelopeService,
+		addressService,
+		threadMessageService,
+	);
+
+	const msg = {
+		uid: 42,
+		seq: 1,
+		size: 100,
+		internalDate: new Date(0),
+		flags: [],
+		envelope: { ...emptyEnvelope, ...envelope },
+	} as unknown as ImapMessage;
+
+	await (
+		service as unknown as {
+			saveMessage: (
+				mailboxId: string,
+				accountId: string,
+				accountConfigId: string,
+				msg: ImapMessage,
+			) => Promise<unknown>;
+		}
+	).saveMessage("mbx-1", "acct-1", "cfg-1", msg);
+
+	return saved;
+};
+
+const spoof: ImapAddress = {
+	name: "matthijs@ischen.nl",
+	mailbox: "aramirez",
+	host: "secresaludguaviare.gov.co",
+};
+
+const onlyAddress = async (
+	envelope: Partial<ImapEnvelope>,
+): Promise<CreateAddressInput> => {
+	const { addresses } = await harvest(envelope);
+	assert.equal(addresses.length, 1);
+	const [input] = addresses;
+	assert.ok(input);
+	return input;
+};
+
+describe("harvesting an envelope display name", () => {
+	it("drops a name that is an address the row does not own", async () => {
+		const input = await onlyAddress({ from: [spoof] });
+
+		assert.equal(input.displayName, "");
+		assert.equal(input.normalizedEmail, "aramirez@secresaludguaviare.gov.co");
+		assert.equal(
+			input.normalizedCompound,
+			"aramirez@secresaludguaviare.gov.co",
+		);
+	});
+
+	/**
+	 * The incident with one word prepended. An anchored guard reads this as an
+	 * ordinary name and stores it, and autocomplete then ties it with the real
+	 * address on the term `matthijs` and breaks the tie on correspondence. The
+	 * word itself is not the lie, so it survives the address being removed.
+	 */
+	it("keeps what a name says besides the address it claims", async () => {
+		const input = await onlyAddress({
+			from: [{ ...spoof, name: "Matthijs <matthijs@ischen.nl>" }],
+		});
+
+		assert.equal(input.displayName, "Matthijs");
+		assert.equal(
+			input.normalizedCompound,
+			"matthijs aramirez@secresaludguaviare.gov.co",
+		);
+	});
+
+	it("keeps a name a sender wrote its own support address into", async () => {
+		const input = await onlyAddress({
+			from: [
+				{
+					name: "Support (support@acme.com)",
+					mailbox: "noreply",
+					host: "acme.com",
+				},
+			],
+		});
+
+		assert.equal(input.displayName, "Support");
+	});
+
+	it("keeps a name that is the address it labels", async () => {
+		const input = await onlyAddress({
+			from: [
+				{
+					name: "ING@ing-nl-mailing.nl",
+					mailbox: "ing",
+					host: "ing-nl-mailing.nl",
+				},
+			],
+		});
+
+		assert.equal(input.displayName, "ING@ing-nl-mailing.nl");
+		assert.equal(
+			input.normalizedCompound,
+			"ing@ing-nl-mailing.nl ing@ing-nl-mailing.nl",
+		);
+	});
+
+	it("keeps a non-ASCII name that is the address it labels", async () => {
+		const input = await onlyAddress({
+			from: [
+				{ name: "Özcan@example.com", mailbox: "Özcan", host: "example.com" },
+			],
+		});
+
+		assert.equal(input.displayName, "Özcan@example.com");
+	});
+
+	it("keeps an ordinary human name", async () => {
+		const input = await onlyAddress({
+			from: [
+				{ name: "Matthijs van Henten", mailbox: "matthijs", host: "ischen.nl" },
+			],
+		});
+
+		assert.equal(input.displayName, "Matthijs van Henten");
+		assert.equal(
+			input.normalizedCompound,
+			"matthijs van henten matthijs@ischen.nl",
+		);
+	});
+
+	it("drops the name on every harvested envelope role", async () => {
+		const { addresses } = await harvest({
+			from: [spoof],
+			sender: [spoof],
+			replyTo: [spoof],
+			to: [spoof],
+			cc: [spoof],
+			bcc: [spoof],
+		});
+
+		assert.equal(addresses.length, 6);
+		for (const input of addresses) {
+			assert.equal(input.displayName, "");
+		}
+	});
+
+	it("still harvests the address from every envelope role", async () => {
+		const named = (mailbox: string): ImapAddress[] => [
+			{ name: "Someone", mailbox, host: "example.com" },
+		];
+		const { addresses } = await harvest({
+			from: named("from"),
+			sender: named("sender"),
+			replyTo: named("reply-to"),
+			to: named("to"),
+			cc: named("cc"),
+			bcc: named("bcc"),
+		});
+
+		assert.deepEqual(
+			addresses.map((input) => input.normalizedEmail),
+			[
+				"from@example.com",
+				"sender@example.com",
+				"reply-to@example.com",
+				"to@example.com",
+				"cc@example.com",
+				"bcc@example.com",
+			],
+		);
+		for (const input of addresses) {
+			assert.equal(input.displayName, "Someone");
+		}
+	});
+
+	it("drops the name on the envelope the message header renders", async () => {
+		const { envelopeAddresses } = await harvest({ from: [spoof] });
+
+		assert.equal(envelopeAddresses.length, 1);
+		assert.equal(envelopeAddresses[0]?.displayName, "");
+	});
+
+	it("keeps the sender label's text and drops only the address", async () => {
+		const { threadMessages } = await harvest({
+			from: [{ ...spoof, name: "Support <matthijs@ischen.nl>" }],
+		});
+
+		assert.equal(threadMessages[0]?.fromName, "Support");
+	});
+
+	it("drops the sender label the message list shows", async () => {
+		const { threadMessages } = await harvest({ from: [spoof] });
+
+		assert.equal(threadMessages.length, 1);
+		assert.equal(threadMessages[0]?.fromName, undefined);
+		assert.equal(
+			threadMessages[0]?.fromEmail,
+			"aramirez@secresaludguaviare.gov.co",
+		);
+	});
+
+	it("keeps the sender label when it is an ordinary name", async () => {
+		const { threadMessages } = await harvest({
+			from: [
+				{ name: "Alejandro Ramirez", mailbox: "aramirez", host: "example.gov" },
+			],
+		});
+
+		assert.equal(threadMessages[0]?.fromName, "Alejandro Ramirez");
+	});
+});

package/src/message-sync.ts

@@ -11,6 +11,7 @@ import type {
 	MailboxItem,
 	ThreadMessageItem,
 } from "@remit/data-ports";
+import { storedDisplayName } from "@remit/data-ports/display-name";
 import {
 	deriveAddressId,
 	deriveBodyPartId,
@@ -85,6 +86,19 @@ export const isParseableEmailAddress = (
 	return host.includes(".");
 };
 
+/**
+ * The name an envelope carries for an address, as it should be stored: any
+ * claim to be some other address removed (issue #826), the rest of the name
+ * kept. Refused wherever a name lands — the address book, the envelope the
+ * message header renders, and the sender label on the thread row.
+ */
+export const harvestedDisplayName = (
+	address: ImapAddress | undefined,
+): string => {
+	if (!address?.name) return "";
+	return storedDisplayName(address.name, `${address.mailbox}@${address.host}`);
+};
+
 /**
  * Parse an external `Date:` header into an epoch-millisecond integer.
  *
@@ -1402,7 +1416,7 @@ export class MessageSyncService {
 			addressData.push({
 				localPart: addr.mailbox,
 				domain: addr.host,
-				displayName: addr.name || "",
+				displayName: harvestedDisplayName(addr),
 				order: i,
 			});
 		}
@@ -1505,12 +1519,14 @@ export class MessageSyncService {
 
 		// Extract sender info. When the server could not parse the From address,
 		// omit fromEmail rather than persist a fabricated string — a display name
-		// may still be present and useful, so keep it.
+		// may still be present and useful, so keep it. This is the sender label the
+		// message list shows and the search index tokenizes, so it takes the same
+		// guard as the address book (issue #826).
 		const fromAddr = envelope.from?.[0];
 		const fromEmail = isParseableEmailAddress(fromAddr)
 			? `${fromAddr?.mailbox}@${fromAddr?.host}`.toLowerCase()
 			: undefined;
-		const fromName = fromAddr?.name;
+		const fromName = harvestedDisplayName(fromAddr) || undefined;
 
 		// Calculate reference order (position in the thread chain)
 		// references.length gives the position since References = [root, parent1, parent2, ...]