Repository navigation
Add-to: check add to from against the stored original - #42
Merged
Merged
Conversation
The stored-parent add-to steps checked terminal and time travel but not that add to from is a participant of the stored original. The only check listed (step 1) is against the incoming header's own from and to, which the sender writes, so an outsider could name themselves there and have a stored message attached to an address of their choosing. NOTE I and section 12 already require add to from to be an original participant; this makes the receiving steps check it against the stored message. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clarifies the receiving steps for an add-to whose original is stored. A new step, 6.3.3.3 in SPECIFICATION.md (and the matching bullet in SPEC.md), says add to from MUST be in the stored message's from or to, else REJECT code 1.
Why: step 1 only checks add to from against the incoming header's own from/to, which the sender writes. Without checking the stored message, any host that knows a message's hash (it's the pid of any later reply) can name itself in from and add to from and have the stored original delivered to an address it picks. NOTE I and §12 already require add to from to be an original participant; this states where the receiver checks it. Found by a security review of fmsgd; the implementation fix is markmnl/fmsgd#52.
🤖 Generated with Claude Code