GNOME Bugzilla – Bug 791275
Partially possible to display faked/spoiled email sender addresses
Last modified: 2018-02-05 11:42:20 UTC
You seem to be affected to https://www.mailsploit.com at least to some degree. I could get a potus@whitehouse.gov" <potus@whitehouse.gov>? as an example. This looks a bit destroyed but users may still recognize it as a valid mail. Image 1/Variation #2 And with variation #5 I can see potus@whitehouse.gov in the overview, at least. See image 2.
Created attachment 365043 [details] Image 1/Variation #2
By finder of the vuln: > Variation #5 is simply the email as the sender name. But, indeed, disturbing, should had been caught by the spam filter. https://twitter.com/pwnsdx/status/938092077484838912
Hey, thanks for reporting this. I'll look into a fix ASAP.
But the real sender @mailsploit.com is always visible. Well, it's grey, while From is black bold..
Sure, but in the overview that's not really visible: https://pbs.twimg.com/media/DQTEDlVX0AE5fh4.jpg:large
This has been fixed on master by commit b7eea857. I can't really port the full fix to geary-0.12 since it's pretty invasive and would require a string change, but after some testing I'll at least cherry pick commit 71e0e683 since that's the most important part of it.
This needed a bit more work than just the original patch set, so I'm not going to get this into 0.12, rather it will need to wait for 0.13.