1778915 - Sending a message as attachment leads to unwanted X-Mozilla-Cloud-Part: cloudFile; header plus url with data constituting a privacy breach

Status: RESOLVED FIXED

(MailNews Core :: Composition, defect)

Description

[b1]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36 Edg/103.0.1264.49

Steps to reproduce:

Attach a message as a message attachment.

Actual results:

The attachment header has:

X-Mozilla-Cloud-Part: cloudFile;
url=imap-message://[e-mail]/INBOX/Test#75
Content-Type: message/rfc822; charset=UTF-8; name="test.eml"
Content-Disposition: attachment; filename="test.eml"
Content-Transfer-Encoding: 7bit

Expected results:

The X-Mozilla-Cloud-Part is not needed, the second line constitutes a privacy breach, it's none of the recipients business to know the internals of the senders message storage.

Comment 1

[b1]

https://searchfox.org/comm-central/rev/cd3088d72a9a397af39540a47a785e31581a8ccc/mailnews/compose/src/MimeMessageUtils.jsm#421
https://searchfox.org/comm-central/rev/cd3088d72a9a397af39540a47a785e31581a8ccc/mailnews/compose/src/MimeMessage.jsm#398
Likely regressed by bug 1670791.

Comment 2

[b1]

https://github.com/Betterbird/thunderbird-patches/blob/main/102/bugs/1778915-no-cloud-part-for-rfc822-attachment.patch

Comment 3

[John Bieling (:TbSync)]

I found the same, still testing a few things.

Comment 4

[John Bieling (:TbSync)]

Attachment: Bug 1778915 - Add x-mozilla-cloud-part header only for cloudFile attachments. r=#thunderbird-reviewers

Comment 5

[b1]

Aesthetically it's unclear why you enter getXMozillaCloudPart() for non-cloud attachments, hence our proposal with the if-block outside the function.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/ca922791520a
Add x-mozilla-cloud-part header only for cloudFile attachments. r=thunderbird-reviewers,rjl

Comment 7

[John Bieling (:TbSync)]

Comment on attachment 9284889 [details]
Bug 1778915 - Add x-mozilla-cloud-part header only for cloudFile attachments. r=#thunderbird-reviewers

[Approval Request Comment]
Regression caused by (bug #):
1670791
User impact if declined:
Leak info about IMAP folder structure / account name in wrongly added x-mozilla-cloud-part header

Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky):
Low, I only added an if-condition to include the header only if the attachment is a cloudFile attachment

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9284889 [details]
Bug 1778915 - Add x-mozilla-cloud-part header only for cloudFile attachments. r=#thunderbird-reviewers

[Triage Comment]
Approved for beta

Comment 9

[Rob Lemley [:rjl]]

Thunderbird 103.0b5:
https://hg.mozilla.org/releases/comm-beta/rev/1ee449b3665e

Comment 10

[John Bieling (:TbSync)]

Comment on attachment 9284889 [details]
Bug 1778915 - Add x-mozilla-cloud-part header only for cloudFile attachments. r=#thunderbird-reviewers

[Approval Request Comment]
Regression caused by (bug #):
1670791
User impact if declined:
Leak info about IMAP folder structure / account name in wrongly added x-mozilla-cloud-part header

Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky):
Low, I only added an if-condition to include the header only if the attachment is a cloudFile attachment

Comment 11

[Wayne Mery (:wsmwk)]

Comment on attachment 9284889 [details]
Bug 1778915 - Add x-mozilla-cloud-part header only for cloudFile attachments. r=#thunderbird-reviewers

[Triage Comment]
Approved for esr102

Comment 12

[Rob Lemley [:rjl]]

Thunderbird 102.0.3:
https://hg.mozilla.org/releases/comm-esr102/rev/f7ef690288f2