784377 - support.mozilla.org private email spam

Status: RESOLVED FIXED

(support.mozilla.org :: Users and Groups, task, P3)

Description

[Sebi]

Attachment: denial_of_service_after_mass_spam.swf

User Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.79 Safari/537.1

Steps to reproduce:

Spam an user with private emails


Actual results:

All the spam messages are sent

After user gets more than 1000 emails the https://support.mozilla.org/en-US/messages becomes hard to use (browser tries to load all in one page)

basically it creates a denial of service for that user


Expected results:

There should be a blocking mechanism

Comment 1

[Sebi]

Attachment: email inbox (private email not mozilla app)

Also the private email is filled. 

Abusing the email could affect the mozilla mail server, because you cannot sent emails forever. And this can affect other users causing a massive email denial of service

Comment 2

[Ricky Rosario [:rrosario, :r1cky]]

Seems like we need to do 2 things:
1- Add rate limiting to private messaging
2- Paginate the message list

Comment 3

[James Socol [:jsocol, :james]]

(In reply to Sebi from comment #1)
> Abusing the email could affect the mozilla mail server, because you cannot
> sent emails forever. And this can affect other users causing a massive email
> denial of service

This is unlikely. We use a third party for outgoing mail.

(In reply to Ricky Rosario [:rrosario, :r1cky] from comment #2)
> Seems like we need to do 2 things:
> 1- Add rate limiting to private messaging
> 2- Paginate the message list

[wsec-low]?

Comment 4

[Ricky Rosario [:rrosario, :r1cky]]

Adding this to the next sprint. Making it a 1pter to implement comment 2 which is straightforward since we have helpers/decorators for ratelimiting and pagination already.

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

In a pull request:
https://github.com/mozilla/kitsune/pull/1338

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

Landed on master:
https://github.com/mozilla/kitsune/commit/7622ca67ee1c69eb2ad074051dbad57e1d0beb26
https://github.com/mozilla/kitsune/commit/e5546126e8f978d3913e2cc9c3f6b33e3c7d9701

Comment 7

[Ricky Rosario [:rrosario, :r1cky]]

Deployed to prod now.

Comment 8

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.