phishing warning

Hello, Our communication departement email are seen with

Tue, 17 Mar 2009 15:22:01 +0000

Hello, Our communication departement email are seen with phishing warning. So I added some traces in ./lib/Horde/MIME/Viewer/html.php around line 117 preg_match('/\.?([^\.\/]+\.[^\.\/]+)[\/?]/', $link, $host1); preg_match('/\.?([^\.\/]+\.[^\.\/ ]+)([\/ ].*)?$/', $target, $host2); if (!(count($host1) && count($host2)) || strcasecmp($host1[1], $host2[1]) !== 0) { Horde::logMessage("tracedom2 l:$link t:$target ".$host1[1]." ".$host2[1], __FILE__, __LINE__, PEAR_LOG_ERR); $data = preg_replace('/href\s*=\s*["\']?\s*(?:http|https|ftp):\/\/' . preg_quote($m[1][$i], '/') . '["\']?[^>]*>\s*(?:(?:http|https|ftp):\/\/)?' . preg_quote($m[2][$i], '/') . '<\/a/is', 'class="mimeStatusWarning" $0', $data); $phish_warn = true; } it produces that: tracedom2 l:www.univmed.fr/communication/?id=45418&file=seminaires_mars_09.doc t:www.univmed.fr/communication/^M ?id=45418&file=seminaires_mars_09.doc univmed.fr ^M ?id=45418&file=seminaires_mars_09.doc [pid 30835 on line 120 of "/var/www/perso/horde-webmail-1.2.2/lib/Horde/MIME/Viewer/html.php"] which means: link and target are equal (may be should we test for equality first, could be faster than regexp..) and after there is a confusion for the value of host2. Debugging the regular expression is not easy. I have no patch to put. Prefer leave Mickael have a look.. I'm quite sure that /?id= is confusing the regexp Dom

> Hello, > > Our communication departement email are seen

Tue, 17 Mar 2009 15:44:18 +0000

> Hello, > > Our communication departement email are seen with phishing warning. > So I added some traces in ./lib/Horde/MIME/Viewer/html.php around > line 117 > > preg_match('/\.?([^\.\/]+\.[^\.\/]+)[\/?]/', > $link, $host1); > preg_match('/\.?([^\.\/]+\.[^\.\/ ]+)([\/ > ].*)?$/', $target, $host2); > if (!(count($host1) && count($host2)) || > strcasecmp($host1[1], $host2[1]) !== 0) { > Horde::logMessage("tracedom2 l:$link t:$target ".$host1[1]." > ".$host2[1], __FILE__, __LINE__, PEAR_LOG_ERR); > $data = > preg_replace('/href\s*=\s*["\']?\s*(?:http|https|ftp):\/\/' . > preg_quote($m[1][$i], '/') . > '["\']?[^>]*>\s*(?:(?:http|https|ftp):\/\/)?' . preg_quote($m[2][$i], > '/') . '<\/a/is', 'class="mimeStatusWarning" $0', $data); > $phish_warn = true; > } > > it produces that: > tracedom2 > l:www.univmed.fr/communication/?id=45418&file=seminaires_mars_09.doc > t:www.univmed.fr/communication/^M > ?id=45418&file=seminaires_mars_09.doc univmed.fr ^M > ?id=45418&file=seminaires_mars_09.doc [pid 30835 on line 120 of > "/var/www/perso/horde-webmail-1.2.2/lib/Horde/MIME/Viewer/html.php"] > > which means: > link and target are equal (may be should we test for equality first, > could be faster than regexp..) and after there is a confusion for the > value of host2. Debugging the regular expression is not easy. I have > no patch to put. Prefer leave Mickael have a look.. > > I'm quite sure that /?id= is confusing the regexp > > Dom > > > I've added the mail in attachment

In fact, the url is over two lines: Don't know how to patch

Tue, 17 Mar 2009 16:11:29 +0000

In fact, the url is over two lines: Don't know how to patch it, and even it that make sense. Firefox is interpreting as a . S�minaires du mois de mars de l'UMR 891 INSERM - Centre de Recherche en Canc�rologie : www.univmed.fr/communication/ ?id=45418&file=SEMINAIRES_MARS_09.doc What has been rendered to firefox is:

• Séminaires du mois de mars de l'UMR 891 INSERM - Centre de Recherche en Cancérologie : www.univmed.fr/communication/
?id=45418&file=SEMINAIRES_MARS_09.doc

>> Hello, >> >> Our communication departement email are seen with phishing warning. >> So I added some traces in ./lib/Horde/MIME/Viewer/html.php around >> line 117 >> >> preg_match('/\.?([^\.\/]+\.[^\.\/]+)[\/?]/', >> $link, $host1); >> preg_match('/\.?([^\.\/]+\.[^\.\/ ]+)([\/ >> ].*)?$/', $target, $host2); >> if (!(count($host1) && count($host2)) || >> strcasecmp($host1[1], $host2[1]) !== 0) { >> Horde::logMessage("tracedom2 l:$link t:$target ".$host1[1]." >> ".$host2[1], __FILE__, __LINE__, PEAR_LOG_ERR); >> $data = >> preg_replace('/href\s*=\s*["\']?\s*(?:http|https|ftp):\/\/' . >> preg_quote($m[1][$i], '/') . >> '["\']?[^>]*>\s*(?:(?:http|https|ftp):\/\/)?' . preg_quote($m[2][$i], >> '/') . '<\/a/is', 'class="mimeStatusWarning" $0', $data); >> $phish_warn = true; >> } >> >> it produces that: >> tracedom2 >> l:www.univmed.fr/communication/?id=45418&file=seminaires_mars_09.doc >> t:www.univmed.fr/communication/^M >> ?id=45418&file=seminaires_mars_09.doc univmed.fr ^M >> ?id=45418&file=seminaires_mars_09.doc [pid 30835 on line 120 of >> "/var/www/perso/horde-webmail-1.2.2/lib/Horde/MIME/Viewer/html.php"] >> >> which means: >> link and target are equal (may be should we test for equality first, >> could be faster than regexp..) and after there is a confusion for the >> value of host2. Debugging the regular expression is not easy. I have >> no patch to put. Prefer leave Mickael have a look.. >> >> I'm quite sure that /?id= is confusing the regexp >> >> Dom >> >> >> > > I've added the mail in attachment >

Changes have been made in CVS for this ticket: http://cvs.h

Wed, 18 Mar 2009 22:40:27 +0000

Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/framework/MIME/MIME/Viewer/Attic/html.php?rt=horde&r1=1.14.4.32&r2=1.14.4.33&ty=u

Fixed.

Wed, 18 Mar 2009 22:49:28 +0000

Fixed.