-
Notifications
You must be signed in to change notification settings - Fork 65
Open
Description
Given a DKIM signature something like this one ...
DKIM-Signature: v=1; d=exampl.com; s=banana;
a=rsa-sha256; q=dns/txt; t=1758184992; c=relaxed/simple;
h=Date:To:From:Subject:Message-ID:X-Mailer:MIME-Version:Content-Type;
z=Date:Thu,=2018=20Sep=202025=2010:43:12=20+0200
|To:Steve=20Example=20<steve@example.com>
|From:=3D?iso-8859-1?Q?Steve_A=3DE6r=3DF8b=3DE5d?=3D=20<test@example.com>
|Subject:Testing=20e-mail=20delivery=20-=20
|Message-ID:<2XHGoCCQWzl8qMiFxROga9hoRk27Sudtpz7anqmHw@do.mcnally.dk>
|MIME-Version:1.0
|Content-Type:multipart/alternative=3B=20boundary=3D"b1_2XHGoCCQWzl8qMiFxR
Oga9hoRk27Sudtpz7anqmHw";
bh=rQbaGWU+E5hro2qduBd5Ip6T/Cw+iAR9SUe+JONP2Qg=;
b=WcFdMG/frqHUr0JsiGnP7BIDIbEDBSNZu9xTiojagO9Qfx3Dgh7suf+ozGsG/zz061e8rlgVp
NvA+I+HN1KKMDnmi7HCkafYlvvW8ziUMZTHrZk7D0AkGFZ4GNvMbBSumAIM3PSZ+RwQcgE7GQ
59AkncvTKqRUOuvUV5zDB2WBY=
.. validation will fail with "signature did not verify: crypto/rsa: verification error".
What's happening is that the removeSignature() function uses a regexp (b\s*=)[^;]+ to remove the body of the b= tag. That regexp matches several things in the header, including the "b=3D" Q-encoded content in the subject line included in the z= field and deletes to the end of the field in each case. That leads to the hash being wrong and the verification fails.
It looks like a relatively simple fix. I'll take a look at a PR.
Metadata
Metadata
Assignees
Labels
No labels