wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-27 02:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Bug 1613623 - For IMAP, no longer allow STARTTLS when server sends PREAUTH greeting.

Browse source 
Tag #1312
This commit is contained in:
Gaming4JC 2020-06-09 23:37:32 -04:00 • committed by Roy Tam
commit c0409464b6
1 changed files with 35 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

54
mailnews/imap/src/nsImapProtocol.cpp
View file

@ -1526,28 +1526,44 @@ void nsImapProtocol::EstablishServerConnection()
} }
else if (!PL_strncasecmp(serverResponse, ESC_PREAUTH, ESC_PREAUTH_LEN)) else if (!PL_strncasecmp(serverResponse, ESC_PREAUTH, ESC_PREAUTH_LEN))
{ {
// we've been pre-authenticated. // PREAUTH greeting received. We've been pre-authenticated by the server.
// we can skip the whole password step, right into the // We can skip sending a password and transition right into the
// kAuthenticated state // kAuthenticated state; but we won't if the user has configured STARTTLS.
GetServerStateParser().PreauthSetAuthenticatedState(); // (STARTTLS can only occur with the server in non-authenticated state.)
if (!(m_socketType == nsMsgSocketType::alwaysSTARTTLS ||
m_socketType == nsMsgSocketType::trySTARTTLS)) {
GetServerStateParser().PreauthSetAuthenticatedState();
if (GetServerStateParser().GetCapabilityFlag() == kCapabilityUndefined) if (GetServerStateParser().GetCapabilityFlag() == kCapabilityUndefined)
Capability(); Capability();
if ( !(GetServerStateParser().GetCapabilityFlag() & if (!(GetServerStateParser().GetCapabilityFlag() &
(kIMAP4Capability | kIMAP4rev1Capability | kIMAP4other) ) ) (kIMAP4Capability | kIMAP4rev1Capability | kIMAP4other))) {
{ // AlertUserEventUsingId(MK_MSG_IMAP_SERVER_NOT_IMAP4);
// AlertUserEvent_UsingId(MK_MSG_IMAP_SERVER_NOT_IMAP4); SetConnectionStatus(NS_ERROR_FAILURE); // stop netlib
} else {
// let's record the user as authenticated.
m_imapServerSink->SetUserAuthenticated(true);
ProcessAfterAuthenticated();
// the connection was a success
SetConnectionStatus(NS_OK);
}
} else {
// STARTTLS is configured so don't transition to authenticated state. Just
// alert the user, log the error and drop the connection. This may
// indicate a man-in-the middle attack if the user is not expecting
// PREAUTH. The user must change the connection security setting to other
// than STARTTLS to allow PREAUTH to be accepted on subsequent IMAP
// connections.
AlertUserEventUsingName("imapServerDisconnected");
const nsCString &hostName = GetImapHostName();
MOZ_LOG(
IMAP, LogLevel::Error,
("PREAUTH received from IMAP server %s because STARTTLS selected. "
"Connection dropped",
hostName.get()));
SetConnectionStatus(NS_ERROR_FAILURE); // stop netlib SetConnectionStatus(NS_ERROR_FAILURE); // stop netlib
}
else
{
// let's record the user as authenticated.
m_imapServerSink->SetUserAuthenticated(true);
ProcessAfterAuthenticated();
// the connection was a success
SetConnectionStatus(NS_OK);
} }
} }