Filter with multiple 'From:' misbehaves

RESOLVED WORKSFORME

Status

RESOLVED WORKSFORME
3 years ago
7 months ago

People

(Reporter: MarkFilipak.mozilla, Unassigned)

Tracking

38 Branch
x86_64
Linux

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

3 years ago
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.7) Gecko/20150929 Firefox/31.9 PaleMoon/25.7.2
Build ID: 20150929234510

Steps to reproduce:

In the following, the message,
??Shipping update for your Amazon order 113-5836432-4272763???
shown in the filter logs is a phishing email.
Note that the "??" and "???" are Unicode chars that my editor refuses to handle properly, though I have it set to edit Unicode.

The message header is
From: "Amazon.com" <Amazon@foregicare.xyz>

In a nutshell:
The 'From:' header is not being processed as expected.

Test Cases:

CASE 1 = Filter name: From ends with: .xyz
Match all of the following:
+ From ends with .xyz
RESULTING FILTER LOG 1:
Applied filter "From ends with: .xyz" to message from "Amazon.com" <Amazon@foregicare.xyz> - ??Shipping update for your Amazon order 113-5836432-4272763??? at 01/13/2016 09:06:11 AM tagged

CASE 2 = Filter name: From ends with: .com
Match all of the following:
+ From ends with .com
RESULTING FILTER LOG 2:
Applied filter "From ends with: .com" to message from "Amazon.com" <Amazon@foregicare.xyz> - ??Shipping update for your Amazon order 113-5836432-4272763??? at 01/13/2016 09:06:11 AM tagged

CASE 3 = Filter name: From ends with: .com -AND- .xyz
Match all of the following:
+ From ends with .com
+ From ends with .xyz
RESULTING FILTER LOG 3:
Applied filter "From ends with: .com -AND- .xyz" to message from "Amazon.com" <Amazon@foregicare.xyz> - ??Shipping update for your Amazon order 113-5836432-4272763??? at 01/13/2016 09:06:11 AM tagged



Actual results:

All 3 Test Cases succeed. Note that either CASE 1 or CASE 2 should succeed (depending upon how you interpret what 'ends with' means regarding '"Amazon.com" <Amazon@foregicare.xyz>'), but CASE 3 should be impossible in any event (but CASE 3 also succeeds).

Also, in the tests, I put the above filter rules ahead of my regular rules in the processing. Though the rules above should not prevent subsequent rules, they do.



Expected results:

I expected the successful filter rule would be:
Match all of the following:
+ From ends with .xyz>
but that rule FAILS!
(Reporter)

Updated

3 years ago
OS: Unspecified → Linux
Hardware: Unspecified → x86_64

Updated

3 years ago
Component: Untriaged → Filters
I cannot reproduce the case 3 using 52.9.0, it fails for me but reporter stated it succeeds. I used
ends with .net
and ends in .edu
Status: UNCONFIRMED → RESOLVED
Last Resolved: 7 months ago
Resolution: --- → WORKSFORME
Summary: Filter on 'From:' misbehaves → Filter with multiple 'From:' misbehaves
You need to log in before you can comment on or make changes to this bug.