388984 - Mailinglist: Mail with .js attachment rejected

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Ben Bucksch (:BenB)]

I just got:
<[e-mail]>: host dm-mail02.mozilla.org[63.245.208.176] said:
    550 5.7.0 Reject, id=10326 - BANNED: multipart/mixed |
    application/x-javascript,.asc,commandlineValidator.js (in reply to end of
    DATA command)

This shouldn't happen. JavaScript file attachments are commonplace in Mozilla development context, they should not be banned as potential worms.

Comment 1

[Reed Loden [:reed]]

.js is banned for a reason, as JavaScript files could contain viruses/etc. Can you just rename it something else or zip it first?

Comment 2

[Ben Bucksch (:BenB)]

I know that it's "banned for a reason, could contain viruses/etc.". I explicitly stated so in the initial description.
Any spam/virus filter is a tradeoff between harmful and valid uses. In normal setups, .js are almost always malice.
Not so here at mozilla.org. A lot of our code is in .js files. It is completely normal and valid and even important to mail .js files around. Thus, the normal assumption ".js = probably a virus" simply is completely wrong here.

No, I can't just rename or ZIP them, because:
- I assumes I know about the restriction. I get a mail delivery failed, but that causes me extra work, and most "delivery failure" mails in my inbox are spam, so I miss a lot of them.
- It costs me extra work
- It costs the recipient extra work. Changes are good that he doesn't use it.
- It cannot be read inline when ZIPped, and needs extra instructions when renamed extension.

This is pointless, we write JS code and should be able to mail .js files around without problem. You surely have other virus/spam filters which will catch the same malice bad mails, and even if not, I need to have protections anyways, I can't rely on you anyways.

Please fix this. This interferes with Mozilla work.

Comment 3

[Reed Loden [:reed]]

Over to Justin for a final decision.

Comment 4

[Dave Miller [:justdave]]

07:49:10 < justin> I dont have a strong opinion either way, but seems reasonable to unblock unless thaat is opening a huge hole

Size of the hole is debatable, but I guess it's been a while since I've seen any active exploits using it (even on my unfiltered accounts).  We'll try it for a while I guess.  Not everyone at our company is tech savvy anymore these days so I'm always nervous about loosening this type of stuff on the assumption that we all know how to be careful.

Comment 5

[Dave Miller [:justdave]]

OK, js has been unblocked on the main mail gateway.  It's still blocked on lists.mozilla.org, which has most of the public mailing lists on it.

Comment 6

[Ben Bucksch (:BenB)]

> OK, js has been unblocked on the main mail gateway.

Thanks.

> It's still blocked on lists.mozilla.org

I ran into this on security-group, i.e. a list. I don't see why .js should be blocked on Mozilla discussion lists.

> Not everyone at our company is tech savvy 

I'm talking about the Mozilla project (and Mozilla developers), not a company.

Comment 7

[Dave Miller [:justdave]]

security-group isn't on lists.mozilla.org, it's on the internal list server, so that mailing list was affected by this fix.  lists.mozilla.org is only the stuff gatewayed to the newsgroups, which includes all of the public support lists that end users use.