782330 - Whine emails show the summary of security sensitive bugs

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[(no longer active)]

Thee emails are not encrypted, so third-parties could read the summary of those emails by intercepting them.

Comment 1

[David Lawrence [:dkl]]

Question: Should we encrypt the whole email if one or more of the bugs list is a secure bug and leave the summary and other bug attributes intact, or should we create a hook and go through each list of bugs returned and remove the summary other information and leave a sanitized version of the summary in its place?

Number 1 would analyze the email bodies for bug ids, and then if one or more is secure, then encrypt the entire multipart message. Slightly less maintainable if the whine templates change slightly.

Number 2 could be done fairly simply by adding a hook into whine.pl that SecureMail could use that looks through the bug list before it is sent to the mail templates. Then we would just replace the summary for the secure bugs with a sanitized subject and leave the email unencrypted. 

Preferences? I tend to lean towards number 2 although we would need to push the hook upstream as well whereas number 1 could be done entirely in SecureMail extension.

dkl

Comment 2

[(no longer active)]

I don't really have a strong preference either way, so I'll leave this for you to decide.  :-)

Comment 3

[Gervase Markham [:gerv]]

I'd prefer number 2. If we encrypt the whole email, that's just another barrier to people reading and acting on it :-)

Gerv

Comment 4

[David Lawrence [:dkl]]

Ok. Will work on a patch for #2.

Comment 5

[David Lawrence [:dkl]]

Attachment: Patch to filter secure bug data in whine emails (v1)

Comment 6

[Gervase Markham [:gerv]]

Comment on attachment 651821 [details] [diff] [review]
Patch to filter secure bug data in whine emails (v1)

Looks good to me. Did you test it?

Gerv

Comment 7

[David Lawrence [:dkl]]

(In reply to Gervase Markham [:gerv] from comment #6)
> Looks good to me. Did you test it?
> 
> Gerv

Of course :) Well in that I created two bugs, one secure and one not. Then created a saved search that included those two bug ids. Then scheduled a new whine that used that saved search as the query and sent it to myself. When viewing the data/mailer.testfile, I observed that the secure bug had all attributes scrubbed and the summary stated (Secure bug) while the insecure bug was untouched. It all seemed correct to me.

dkl

Comment 8

[(no longer active)]

(In reply to comment #7)
> (In reply to Gervase Markham [:gerv] from comment #6)
> > Looks good to me. Did you test it?
> > 
> > Gerv
> 
> Of course :) Well in that I created two bugs, one secure and one not. Then
> created a saved search that included those two bug ids. Then scheduled a new
> whine that used that saved search as the query and sent it to myself. When
> viewing the data/mailer.testfile, I observed that the secure bug had all
> attributes scrubbed and the summary stated (Secure bug) while the insecure bug
> was untouched. It all seemed correct to me.

FWIW this scenatio matches mine almost perfectly.

Comment 9

[David Lawrence [:dkl]]

Committing to: bzr+ssh://[e-mail]/bmo/4.0
modified whine.pl
modified extensions/SecureMail/Extension.pm
Committed revision 8275.

Committing to: bzr+ssh://[e-mail]/bmo/4.2  
modified whine.pl
modified extensions/SecureMail/Extension.pm                                    
Committed revision 8299.

Comment 10

[Reed Loden [:reed]]

Can we make sure this hook gets pushed upstream?

Comment 11

[David Lawrence [:dkl]]

(In reply to Reed Loden [:reed] from comment #10)
> Can we make sure this hook gets pushed upstream?

Yep. Was getting ready to file the bug :)

dkl

Comment 12

[David Lawrence [:dkl]]

(In reply to David Lawrence [:dkl] from comment #11)
> (In reply to Reed Loden [:reed] from comment #10)
> > Can we make sure this hook gets pushed upstream?
> 
> Yep. Was getting ready to file the bug :)
> 
> dkl

bug 783107

Comment 13

[(no longer active)]

(In reply to comment #2)
> I don't really have a strong preference either way, so I'll leave this for you
> to decide.  :-)

Actually with this deployed, I changed my mind.  It would be really good if those emails can be encrypted.  Without that, my security bug whines have turned pretty useless. :(

Comment 14

[:glob ✱]

since this has been deployed, i've filed a bug 784578 for your request (we can't track to different requests on the same bug).

Comment 15

[(no longer active)]

(In reply to comment #14)
> since this has been deployed, i've filed a bug 784578 for your request (we
> can't track to different requests on the same bug).

Sounds good, thanks!