Closed Bug 1128892 Opened 9 years ago Closed 9 years ago

Random confidential messages attached to another message

Categories

(MailNews Core :: Backend, defect)

Product:
MailNews Core
Component:
Backend
Platform:
x86_64
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 799450

People

(Reporter: comolli, Unassigned)

References

Details

(Keywords: privacy, Whiteboard: [closeme 2015-09-15]) 

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Build ID: 20140923175406

Steps to reproduce:

I edited an old message by using command Message/Edit as new. It is a bullettin to a yahoogroup mailing list. It was in a subfolder with other similar messages.

I've made minor changes (i.e. delete lines from a pre-existing table, changing title and subject)

I've sent.

Thunderbird v. 31.3.0 (italian language)


Actual results:

About 800 kB of old messages (nearly 50 emails!), picked randomly from my mail archive, has been attached and sent to the mailing list!!! Personal and confidential messages has been distributed to about 400 people. Some of the messages include personal private comments that should not have been divulgated...

This message observed from Thunderbird Sent archive shows a 842 kB dimension, but NO attachment icon, and I cannot see the attached random private messages.
Idem from a copy self-sent into the Inbox.

The same message observed from the webmail of my provider instead shows all the attached messages.
Some people that received this message have seen the random private messages, and in their reply I can see all the attachments. 
Other people, looking via Thunderbird, cannot see the attachments like me.

The problem is very bad since there is no way to understand that Thunderbird is attaching your private messages before sending an email!!!!!


Expected results:

I've done this operation hunderd of times and the problem never happened. 
A simple email with no attached messages should have been sent.
Severity: normal → critical
I don't recall hearing anything similar. Are you able to forward the mail to me? (User forward as attachment)
(if accurate it's a privacy issue)
I also have not heard of this.
Can you reproduce with the same original message and steps?  (except of course not send it to the same group of people)
Flags: needinfo?(comolli)
Keywords: privacy
Thanks for the replies.

@Magnus: I'll forward the email to you.

@Wayne: definitely a privacy issue! I've tried to reproduce as you suggest, before making changes below. Same PC, same message, same changes, sent obiously only to me and not to the group again. The problem does NOT happen again. I'm not able to reproduce. Tryed a few times. 

Now I've updated to 31.4.0 and deleted all MSF files. I don't want this to happen again...
Flags: needinfo?(comolli)
I have no explanation. 

THe message has a section

--------------090709070503060602090001
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: base64
Content-ID: <part10.06080203.06070809@libero.it>

This contains a bunch of other messages from the outbox. The one thing that strikes me is that there is no newline in between the messages. E.g. (after decoding)


something....end of previous
</html>
From - Tue May 15 10:42:37 2012


Could this be a because of bug 900175?
I've certainly heard similar things before, they are very bad, and must be re-tested asap:

Bug 498274 meta: problems when compact interferes with other actions
Bug 532395 can't find stuff to attach (often because looking in the wrong place, e.g. in other msgs which have been deleted; but if they haven't, they'll just get attached as in the other bugs)
Bug 766495 Attaching unrelated images from other msgs (exposing confidential data to random recipients!)
Bug 799450 Attaching unrelated text from other msgs (exposing confidential data to random recipients!)
Bug 877159 meta: attach-paradigm-fail (recommended read!)

Lots of these might have been fixed recently by Bug 854798, fixing one of the major causes where compact messed up references. Fix has not yet landed on release and should be uplifted to land in release channels asap!
See Also: → 799450, attach-paradigm-fail
I have had several instances when random mails where attached to the mail I had sent. I do not recall whether this happened with a new mail, or during re-edit. Fixing this is critical, as the consequences can be disastrous when using it in a commercial environment.
script, Cobarcore

#1 turn off automatic compact now in tools | options | advanced | network and disk

#2 can you spot check your mbox file in your program directory (open a copy of the file in an editor)  to see whether, starting at the bottom of the file, that message starts with the form
  From - Tue May 15 10:42:37 2012
 and that the content preceeding that line is a blank, and the lines before that look to be a coherent, full email (back up to it's own From - xxxxx).

(I've been searching for a utility to repair my own corrupted mboxes and not yet found what I want)

(In reply to Magnus Melin from comment #4)
> Could this be a because of bug 900175?

certainly looks something that behaves like that. But I'd think more likely folder corruption, which is not bug 900175.
Component: Untriaged → Backend
Flags: needinfo?(script)
Flags: needinfo?(comolli)
Product: Thunderbird → MailNews Core
Depends on: 900175
FWIW, as I am writing this, I am trying out http://www.freeviewer.org/mbox/
Of course it could also be unrelated to bug 900175 (but we just happen to see bug 900175 "the missing emtpy lines" in the messages sent out)
(In reply to Wayne Mery (:wsmwk, use Needinfo for questions) from comment #8)
> > #2 can you spot check your mbox file in your program directory (open a copy
> of the file in an editor)  to see whether, starting at the bottom of the
> file, that message starts with the form
>   From - Tue May 15 10:42:37 2012
>  and that the content preceeding that line is a blank, and the lines before
> that look to be a coherent, full email (back up to it's own From - xxxxx).

I've not found any "mbox" file, please can you specify in which file I should look?

Thanks for the reply!
Lorenzo
Flags: needinfo?(comolli)
"mbox" is the internal format of the file that is representing a whole folder as shown in Thunderbird. You can determine where that file is located by right-clicking the folder in TB -> Properties -> Location . Then open the file in some text file viewing program (e.g. notepad if it isn't too big). Be sure to NOT make any changes in the file AND NOT SAVE it in that program.
Flags: needinfo?(comolli)
Thank you for explanation.
I've opened the "Sent" file in UltraEdit and found the lines where the sent message starts. I'm not sure to have understood what I need to look. Please let me know.
Here is the text near the start of that problematic sent message.
[...]
--------------070805000703050008010806--

From - Mon Feb 02 14:15:02 2015
X-Account-Key: account3
X-UIDL: 145141
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys: 
[...]

Looking in this message I cannot find the attached messages as txt file, but a big encoded attachment that I imagine contains the other messages.

If needed I can extract part of the mbox file and send to you.
Flags: needinfo?(comolli)
(In reply to Magnus Melin from comment #4)
> I have no explanation. 
> 
> THe message has a section
> 
> --------------090709070503060602090001
> Content-Type: text/html; charset="utf-8"
> Content-Transfer-Encoding: base64
> Content-ID: <part10.06080203.06070809@libero.it>
> 
> This contains a bunch of other messages from the outbox. 

What is actual content in this part? Base54 encoded HTML of text/html sub part of other mail?

What is data before the part?
No text/html subpart which has <img src="cid;part10.06080203.06070809@libero.it"> in HTML source?

If text/html subpart which has <img src="cid;part10.06080203.06070809@libero.it"> in HTML source exists,
the image in HTML should be shown as "broken icon" because content/type is not image, and the text/html part with Content-ID: shoukd be hidden if it's contained in  multipart/related correctly.
Is malformed mail? Or the text/html part with Content-ID: is shown as if attachment because it's not shown as <img> of HTML?

If text/html subpart which has <img src="cid;part10.06080203.06070809@libero.it"> in HTML source exists,
is it same problem as Bug 799450?
(In reply to Magnus Melin from comment #4)
> I have no explanation. 
> 
> THe message has a section
> 
> --------------090709070503060602090001
> Content-Type: text/html; charset="utf-8"
> Content-Transfer-Encoding: base64
> Content-ID: <part10.06080203.06070809@libero.it>

If  Bug 799450 on correctly formatted mail with embed image, "Content-Type: of part which has Content-ID:" should be image/xxx.
Malformed mail?
   multipart/related
      text/html, <img src="cid:ABC">
      text/html, Content-ID: <ABC>, Content-Transfer-Encoding: base64

Or text/html part is embed in HTML mail by <embed>, <object>, <iframe> etc. using Content-ID: and cid url?

	

    Collapse All Comments
    Expand All Comments
Cobarcore, I believe questions in comment 14 and 15 are for you
Flags: needinfo?(comolli)
Whiteboard: [closeme 2015-09-15]
Hi Wada and Wayne,
unfortunately I'm not able to reply to those questions, too technical for me. I can send the full message as I've done with Magnus. Please contact me privately.
Thanks for your interest.
Flags: needinfo?(comolli)
Bug 1180201 is report on similar phenomenon.
Read Bug 799450, Bug 766495, Bug 817245 well, please. And see Bug 854798.

To bug opener: Is your problem same as these bugs? Or different problem?
Do you see your problem in Tb 38?

Note: Latest Thunderbird 38.2.0 has severe problem of Bug 1196662.
      Use Thunderbird 38.1.0, if you doesn't want to experience problem of that bug frequently.
I've tried to undestand the other linked bugs, but they seems quite different. In my case unrelated random text from mail archive was added while editing an older email in html.
After you added (i) mail to archive while editing (ii) an older email in html, if Compact(before fix of bug 854798) happens, msgOffset of mail (i) can be changed to Offset of mail (ii).
So, your case can be explained by Bug 799450 or Bug 766495.
But no one can say anything about "what happened on you and your mail and your message folder" without your detailed description about your case and actual mail meta data such as mail size, offset in folder, and description on "Compct actually occurred or not", ...
Setting dependency to Bug 799450 for ease of analysis/tracking/serch.
Depends on: 799450
No longer depends on: 1201782
Closing as dup of Bug 799450. If your problem is different problem from that bug, re-open, please.
If same phenomenon in Tb 38 or newer, read bug 1201782 well, please.
Status: UNCONFIRMED → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
No longer depends on: 799450
Flags: needinfo?(script)
You need to log in before you can comment on or make changes to this bug.