1782483 - Check usage of "SecondEmail" in enigmailKeyManager.js

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect, P3)

Description

[Thomas D. (:thomas8)]

Let's remove double-check on the uses of "SecondEmail" from encryption territory to prevent cunning bugs!

https://searchfox.org/comm-central/rev/77174e77a7a4dc1eca61d40667af4e1772b5b1ac/mail/extensions/openpgp/content/ui/enigmailKeyManager.js#830

(In reply to Thomas D. (:thomas8) from Bug 1782481 comment #0)

+++ This bug was initially created as a clone of Bug #1777156 +++

We're no longer using "SecondEmail" now that we support more.
So instances of "SecondEmail" in the code have a high risk of causing weird bugs.
We should eliminate those instances before wasting resources on such bugs.

Comment 1

[Thomas D. (:thomas8)]

Kai, are you able to estimate/shortly describe the user impact/severity of using only "SecondEmail" in enigmailDowloadContactKeysEngine(), i.e. skipping all email addresses except the first on each contact?
Should we raise the Priority/Severity here (currently set at P3/S3)?

(In reply to Thomas D. (:thomas8) from comment #0)

Let's remove uses of "SecondEmail" from encryption territory to prevent cunning bugs!

https://searchfox.org/comm-central/rev/77174e77a7a4dc1eca61d40667af4e1772b5b1ac/mail/extensions/openpgp/content/ui/enigmailKeyManager.js#830

Comment 2

[Kai Engert (:KaiE:)]

(In reply to Thomas D. (:thomas8) from comment #1)

Kai, are you able to estimate/shortly describe the user impact/severity of using only "SecondEmail" in enigmailDowloadContactKeysEngine(), i.e. skipping all email addresses except the first on each contact?

That's inside a commented block (unused code), so OpenPGP won't be affected.

Comment 3

[Magnus Melin [:mkmelin]]

Attachment: Bug 1782483 - Remove some dead code from enigmailKeyManager.js. r=kaie

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/6281025f7a52
Remove some dead code from enigmailKeyManager.js. r=kaie