1725033 - OpenPGP key attached multiple times when message is forwarded or edited as new

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect)

Description

[u592880]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67

Steps to reproduce:

1. set up OpenPGP and use the key to sign messages (done by default).
2. send message.
3. go to sentbox, select message sent at step 2, and either forward or "edit as new message"

Actual results:

Whether the message is forwarded or edited as new, the OpenPGP key is automatically re-added to the message, and then added again upon sending the forwarded/new message.

Expected results:

Thunderbird should have seen that the key is already present and prevented its multiple inclusion.

Comment 1

[Magnus Melin [:mkmelin]]

The code around here should check if the same filename was already in there before adding. If it is, just skip adding it once more.
https://searchfox.org/comm-central/rev/2372e390f3b6add0f2b3530964472fa0e2e4463c/mail/extensions/openpgp/content/ui/enigmailMsgComposeOverlay.js#863

Comment 2

[Lasana Murray]

Seems like there is already a check for duplicate attachments here :
https://searchfox.org/comm-central/source/mail/components/compose/content/MsgComposeCommands.js#6692

It checks the file url which is different in this case. On my machine I see /tmp/key.asc for the new attachement and /tmp.nsmail.asc for the previous one. I vote we modify this to also check the content type, and file name instead.

Comment 3

[Lasana Murray]

Attachment: Bug 1725033 - Detect duplicated attachments by content type and name. r=mkmelin

Comment 4

[Lasana Murray]

Attachment: Bug 1725033 - Do not duplicate public key attachment when forwarding signed messages. r=mkmelin

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/1902bce264de
Do not duplicate public key attachment when forwarding signed messages. r=mkmelin

Comment 6

[Uplift Request]

Time for uplift requests?

Comment 7

[u592880]

Updated to latest beta version and this is still happening, with messages either forwarded or edited as new. Since this was marked as resolved before the update, I am not sure whether it should already have shipped in the latest beta.

Comment 8

[Magnus Melin [:mkmelin]]

It's not yet on beta (92) as you can see from the flags above: thunderbird92: affected

I don't think this needs to be rushed.

Comment 9

[Wayne Mery (:wsmwk)]

Comment on attachment 9236679 [details]
Bug 1725033 - Do not duplicate public key attachment when forwarding signed messages. r=mkmelin

[Triage Comment]
Approved for esr91 (preemptively, since I happened to be here)

lasana, please NI rob if you don't want this uplifted yet)

Comment 10

[Lasana Murray]

Should be ok to uplift. Why not to beta first?

Comment 11

[Magnus Melin [:mkmelin]]

It's already in beta now that beta is 93.

Comment 12

[Rob Lemley [:rjl]]

Thunderbird 91.1.1:
https://hg.mozilla.org/releases/comm-esr91/rev/9e8c5eeedc69