1795118 - mail.compose.warn_public_recipients fails for nested mailing lists

Status: NEW

(Thunderbird :: Message Compose Window, defect)

Description

[Marc Auslander]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0

Steps to reproduce:

Created an address list which contains address lists. The fully expanded set of addresses is longer the the public recipients limit. Create an email with the list name in the to field.

Actual results:

No warning of too many recipients in the To: field is created, and the mail can be sent without warning even if aggressive is on.

Expected results:

The check for too many recipients should completely expand the list of lists to get a correct count and create the warning and if aggressive require confirmation.

Comment 1

[Thomas D. (:thomas8)]

I concur, the implementation should be improved to consider the correct count of contacts in a nested mailing list.
This constitutes a substantial and unexpected violation of privacy, including potential legal repercussions when privacy legislation is violated.
Imagine enterprise having Customers America, Customers Europe etc. mailing lists, and a global mailing list containing these sub-lists. Perfectly legitimate and plausible scenario which will fail to alert.

Comment 2

[Thomas D. (:thomas8)]

Confirming for 102.3.3 (64-bit), Win10.
Thunderbird also won't display nested lists well, i. e. it displays and pseudo-allows editing of a sub mailing list item as if it was a single contact.