Thread: Message-ID should surely not be shown as a mailto: URL

Message-ID should surely not be shown as a mailto: URL

From
Tom Lane
Date:
So looking at page source for, eg,
http://archives.postgresql.org/pgsql-hackers/2008-06/msg00338.php

I see

<li><strong>From</strong>: Tom Lane <<a
href="mailto:tgl@DOMAIN.HIDDEN">tgl(at)sss(dot)pgh(dot)pa(dot)us</a>></li>
<li><strong>To</strong>: <a href="mailto:pgsql-hackers@DOMAIN.HIDDEN">pgsql-hackers(at)postgresql(dot)org</a></li>
<li><strong>Subject</strong>: Re: We have a launch abort ... PG update releases will be delayed</li>
<li><strong>Date</strong>: Sat, 07 Jun 2008 11:45:56 -0400</li>
<li><strong>Message-id</strong>: <<a
href="mailto:20506.1212853556@DOMAIN.HIDDEN">20506(dot)1212853556(at)sss(dot)pgh(dot)pa(dot)us</a>></li>

This seems outright silly.  In the first place, I do not see the value
of displaying mailto: URLs containing intentionally-broken addresses.
In the second, even if the domain names were fixed, there is no way on
god's green earth that mailto: a Message-ID is going to work.

Hm, I wonder if sloppiness of this sort accounts for the remarkable
prevalence in my mail logs of spam-sign like this:

Jun  9 00:44:06 sss2 sm-mta[4062]: m594i5Ns004062: <19570.1142971720@sss.pgh.pa.us>... User unknown

I don't pretend to know what is the approved way to deal with these
issues, but *this* can't be best practice.
        regards, tom lane


Re: Message-ID should surely not be shown as a mailto: URL

From
Andrew Sullivan
Date:
On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:
> 
> Hm, I wonder if sloppiness of this sort accounts for the remarkable
> prevalence in my mail logs of spam-sign like this:
> 
> Jun  9 00:44:06 sss2 sm-mta[4062]: m594i5Ns004062: <19570.1142971720@sss.pgh.pa.us>... User unknown

Good bet.

> I don't pretend to know what is the approved way to deal with these
> issues, but *this* can't be best practice.

Obviously, someone is looking for something that _looks_ like a mail
address, attempting to munge it, and on the way through, changing it
to a mailto: link.  I think some parsing of the RFC2821/2822 headers
is needed first, so that one doesn't do this for things like the
message id.   

A

-- 
Andrew Sullivan
ajs@commandprompt.com
+1 503 667 4564 x104
http://www.commandprompt.com/


Re: Message-ID should surely not be shown as a mailto: URL

From
Alvaro Herrera
Date:
Andrew Sullivan wrote:
> On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:

> > I don't pretend to know what is the approved way to deal with these
> > issues, but *this* can't be best practice.
> 
> Obviously, someone is looking for something that _looks_ like a mail
> address, attempting to munge it, and on the way through, changing it
> to a mailto: link.  I think some parsing of the RFC2821/2822 headers
> is needed first, so that one doesn't do this for things like the
> message id.   

Mhonarc does this mangling.  I tried to stop it but couldn't find the
way.  I didn't investigate it too closely though, so most likely there
is a way to make it work.  If anyone wants to spend some time on it,
feel free to send patches.  Our resource files are here:

https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8

The actual mhonarc call is in this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc

The mhonarc documentation:
http://www.mhonarc.org/MHonArc/doc/mhonarc.html


Oh, FWIW, the Message-ID URLs (which are just hard links actually) are
created by this script:
https://pgweb.postgresql.org/browser/trunk/archives/bin/createmsgid.pl

It has a couple of holes (i.e. there are certain types of Message-Ids
for which it doesn't work), so patches are welcome too.

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.


Re: Message-ID should surely not be shown as a mailto: URL

From
Tom Lane
Date:
Andrew Sullivan <ajs@commandprompt.com> writes:
> On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:
>> I don't pretend to know what is the approved way to deal with these
>> issues, but *this* can't be best practice.

> Obviously, someone is looking for something that _looks_ like a mail
> address, attempting to munge it, and on the way through, changing it
> to a mailto: link.  I think some parsing of the RFC2821/2822 headers
> is needed first, so that one doesn't do this for things like the
> message id.   

What I'm complaining about is the logical disconnect involved in
sticking a mailto: onto an address that you have carefully made
unusable for sending mail to.  I don't have a problem with munging
all of them, just leave off the mailto decoration.
        regards, tom lane


Re: Message-ID should surely not be shown as a mailto: URL

From
Bruce Momjian
Date:
Alvaro Herrera wrote:
> Andrew Sullivan wrote:
> > On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:
> 
> > > I don't pretend to know what is the approved way to deal with these
> > > issues, but *this* can't be best practice.
> > 
> > Obviously, someone is looking for something that _looks_ like a mail
> > address, attempting to munge it, and on the way through, changing it
> > to a mailto: link.  I think some parsing of the RFC2821/2822 headers
> > is needed first, so that one doesn't do this for things like the
> > message id.   
> 
> Mhonarc does this mangling.  I tried to stop it but couldn't find the
> way.  I didn't investigate it too closely though, so most likely there
> is a way to make it work.  If anyone wants to spend some time on it,
> feel free to send patches.  Our resource files are here:
> 
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8
> 
> The actual mhonarc call is in this script:
> https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc
> 
> The mhonarc documentation:
> http://www.mhonarc.org/MHonArc/doc/mhonarc.html

I looked at this for a while and am uncertain how to affect the header
display.  When I was dealing with this, I considered the message-id to
be an identifier, rather than something I wanted displayed in the email
header block, so I put it above the header:
http://momjian.us/mhonarc/patches_hold/msg00021.html

Using these mhonarc.rc lines:
<MSGHEAD>Message-ID: $MSGID$</MSGHEAD>

You could even modify this to add a link to show the message by
message-id URL.

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + If your life is a hard drive, Christ can be your backup. +


Re: Message-ID should surely not be shown as a mailto: URL

From
Bruce Momjian
Date:
Alvaro Herrera wrote:
> Andrew Sullivan wrote:
> > On Mon, Jun 09, 2008 at 02:30:55AM -0400, Tom Lane wrote:
> 
> > > I don't pretend to know what is the approved way to deal with these
> > > issues, but *this* can't be best practice.
> > 
> > Obviously, someone is looking for something that _looks_ like a mail
> > address, attempting to munge it, and on the way through, changing it
> > to a mailto: link.  I think some parsing of the RFC2821/2822 headers
> > is needed first, so that one doesn't do this for things like the
> > message id.   
> 
> Mhonarc does this mangling.  I tried to stop it but couldn't find the
> way.  I didn't investigate it too closely though, so most likely there
> is a way to make it work.  If anyone wants to spend some time on it,
> feel free to send patches.  Our resource files are here:
> 
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-current
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common
> https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-utf8
> 
> The actual mhonarc call is in this script:
> https://pgweb.postgresql.org/browser/trunk/archives/bin/mk-mhonarc
> 
> The mhonarc documentation:
> http://www.mhonarc.org/MHonArc/doc/mhonarc.html

Have you tried adding this to your mhonarc.rc file?
<NOMAILTO>

In fact looking at:
https://pgweb.postgresql.org/browser/trunk/archives/bin/resource-common

I see the use of MAILTO even though the comment doesn't match:
<!-- Don't convert e-mail addresses to mailto: URLs -->25     <MAILTO>

It seems logical seeing as we are already using:
<SPAMMODE>

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + If your life is a hard drive, Christ can be your backup. +


Re: Message-ID should surely not be shown as a mailto: URL

From
Alvaro Herrera
Date:
Bruce Momjian wrote:

> Have you tried adding this to your mhonarc.rc file?
> 
>     <NOMAILTO>

Hmm, no, I just added it and the archive is being reprocessed.  The
mailto: links have now been removed; for example see
http://archives.postgresql.org/pgsql-committers/2008-11/msg00111.php
(Mhonarc is still running)

> I see the use of MAILTO even though the comment doesn't match:
> 
>     <!-- Don't convert e-mail addresses to mailto: URLs -->
>     25     <MAILTO>

Ugh.  I assume Marc took the original config file and switched the
setting without even looking at the comment.

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.


Re: Message-ID should surely not be shown as a mailto: URL

From
Alvaro Herrera
Date:
Okay, so Bruce got in Perl hacking mode today and wrote a script to
munge the message-ids.  If you look at our archives you'll notice that
on each message the Message-Id header is now a proper link to the
message itself using the message-id-style URL, and it is no longer
munged by the "no spam" Mhonarc mode.  (Well, actually it is, and it's
de-munged by Bruce's script later on.  We'll be fixing that too
hopefully!)

Thanks Bruce!

-- 
Alvaro Herrera                                http://www.CommandPrompt.com/
PostgreSQL Replication, Consulting, Custom Development, 24x7 support