HTML isn't rendered in mail in PGP-encrypted e-mail originating from Wordpress/Wordfence or Facebook
Categories
(MailNews Core :: Security: OpenPGP, defect)
Tracking
(Not tracked)
People
(Reporter: heinrich.krebs, Unassigned)
Details
Attachments
(2 files)
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0
Steps to reproduce:
I get PGP encrypted mail, that have a HTML content. But the HTML content isn't rendered. The HTML-code is shown instead.
To be specific I have a Wordpress installation running the WP PGP Encrypted Emails and Wordfence Plugins. The later is generating a regular report mail, which is a HTML mail. The former encrypts the eMail before sending.
In Thunderbird the Mail is automatically decrypted, but only the HTML sourcecode is shown. A phenomenon that is also true for automated mails send by Facebook. I added my public PGP key to my Facebook account and mails from Facebook arrive encrypted and signed, but HTML isn't rendered.
Actual results:
See above
Expected results:
I would like HTML mails to be rendered.
Looks like the HTML part has a content type that is not recognised by TB. HTML generally works in OpenPGP. To get to the source of the issue, we need to see a sample message. This is of course tricky since we wouldn't be able to decrypt it. So here's the way forward:
Save such a message onto your desktop. If you still have GnuPG installed, you can then decrypt it using gpg -d xxx.eml > decrypted.txt. Attach decrypted.txt here for inspection (you can obfuscate private information). You could also copy decrypted.txt to decrypted.eml and import it to a folder, I'm not sure whether this would need any clean-up before importing it.
Did that use to work better in TB 68 with Enigmail? Enigmail has an option to permanently decrypt a message, so that would be easier than saving it and decrypting it from the desktop. When re-importing a permanently decrypted message, does it display properly?
|
Reporter | |
Comment 2•5 years ago
|
||
Example of decrypted text...
Wordpress Wordfence plugin and encrypted mail plugin
|
|
Reporter | |
Comment 3•5 years ago
|
||
I have removed original eMail recipient and sender info, therefore the signature and other parts of the mail might be broken.
Note, that the type is given as html...
|
|
Reporter | |
Comment 4•5 years ago
|
||
Did that use to work better in TB 68 with Enigmail?
Enigmail has an option to permanently decrypt a message,
so that would be easier than saving it and decrypting it
from the desktop. When re-importing a permanently
decrypted message, does it display properly?
I don't have (or ever used) TB with Enigmail, so I can't test this.
Since the error also happens with encrypted Facebook mails, everyone with a Facebook account could test it, by inserting one's public key under Settings -> Security and Logins -> Encrypted Mails (or something like that, I translated from German on the fly)
Attachment 9235314 [details] isn't useful since it doesn't contain an e-mail message. Attachment 9235315 [details] has an encrypted message, again not useful. Also, when you attach .eml files, please use MIME type text/plain.
That said, the second attachment gives some indication. As you pointed out, we see this header:
Content-Type: text/html; charset=UTF-8
This seems to be wrong. PGP encrypted would use Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; for a PGP/MIME message. What you have here seems like a gigantic inline PGP part which by definition is plain text, and the declared content type of text/html doesn't change that. As you saw, HTML is displayed in raw format. Overall it looks like the MIME created here is invalid. A quick Google search confirms: For historical reasons PGP/Inline doesn't support sending HTML messages ...
Patrick, can you confirm my assessment?
Fortunately Facebook doesn't send me any mail, so I can't try this myself.
|
||
Comment 6•5 years ago
|
||
The problem with the message is that the lines of the message body are wrapped:
-----BEGIN PGP MESSAGE-----
wf8AAAIMA1pNlMfjzEe9ARAAnvXgrTEdCkOm1I3neXO2JALLMfEcyM88t9iHczhi
scs/QPAa4Oyg
...
-----END PGP MESSAGE-----
This is not allowed according to the OpenPGP specification (RFC 4880), the message is thus not recognized as ASCII armored OpenPGP message.
|
|
Reporter | |
Comment 7•5 years ago
|
||
Would there be a possibility to still force the decrypted text though the HTML renderer?
For it is recognised as encrypted and is decrypted correctly, but the result is html-code not plain text. And obviously there doesn't seem a possibility to correct all the services who do the PGP-process wrong...
|
||
Comment 8•5 years ago
|
||
We process inline pgp by allowing the message to render, and then we try to extract the text from the rendered display.
Because this message has text/html, but it doesn't contain any line break html commands, the whole message is interepreted as a single long line. That's what we get, when we try to extract the message, a single long line.
I think that message is invalid, and maybe the bug is invalid, too.
I think the tool that sends this message must set content-type text/plain, only that guarantees that the BEGIN and END lines, and the data lines, will be on separate lines.
I edited the attached sample message, and changed text/html to text/plain. That caused our code to try to process the message: I then get the error message that I cannot decrypt because of the missing secret key.
|
|
||
Comment 9•5 years ago
|
||
Can you please contact the authors of the software that create these emails, and talk to them? Maybe refer them to this bugzilla ticket?
My assumption is, what you have attached is the direct message that the software sends - and that seems to be clearly invalid.
|
|
||
Comment 10•5 years ago
|
||
I have tested encrypted notifications from Facebook.
The content-type of the email is multipart/encrypted.
Thunderbird decrypts the message, and for me, it renders the HTML content that is inside that message.
It seems you have not attached original messages, but modified messages?
Description
•