feat: store a whitelist of publishable headers in the manifest

report must never open source.eml, so parse decides once what may be
published and report formats only what it is given. To, Cc, Delivered-To and
X-Original-To are absent by construction rather than stripped.

Received is cut to the boundary hop alone, in both directions. Above it are
our own relays; below it is the attacker's own writing, and a forged chain
names an innocent third party there, so publishing a hop below the boundary
puts someone else's address into a report a desk will act on. That is the
third property applied to disclosure rather than to sending_ip().

Truncating the chain was not sufficient on its own: the surviving line is
written by our own relay and records the envelope recipient in its optional
"for <addr>" clause, so the whitelist alone would have published the
victim's address verbatim in the one header a report reproduces in full.
The clause is removed and the rest of the hop kept.

The manifest-wide "no example.org" assertion is narrowed to the headers
block only, where the whitelist deliberately publishes our receiving relay's
name in a by/authserv-id clause. The address itself is still barred there,
asserted separately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xj1ayFRSUQ2u7cwb3S4axE

1 files changed, 62 insertions, 0 deletions

diff --git a/tests/test_parse.py b/tests/test_parse.py
index 11345c7..fa3526a 100644
--- a/tests/test_parse.py
+++ b/tests/test_parse.py
@@ -290,5 +290,67 @@ class TestIocAssembly(unittest.TestCase):
         self.assertNotIn("you%40example.org", blob)
 
 
+class ReportHeaders(unittest.TestCase):
+    def test_the_whitelist_keeps_what_a_desk_needs(self):
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        names = [name for name, _ in headers]
+        for wanted in ("From", "Subject", "Date", "Message-ID", "Reply-To",
+                       "Return-Path", "Authentication-Results", "Received-SPF"):
+            self.assertIn(wanted, names)
+
+    def test_recipient_headers_never_survive_the_whitelist(self):
+        # The first property, at the one place a report reproduces header
+        # text verbatim. A blacklist would have to remember each of these;
+        # the whitelist never names them at all.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        names = [name for name, _ in headers]
+        blob = repr(headers)
+        for name in ("To", "Cc", "Delivered-To", "X-Original-To"):
+            self.assertNotIn(name, names)
+        self.assertNotIn("victim@example.org", blob)
+        self.assertNotIn("colleague@example.org", blob)
+
+    def test_received_stops_at_the_boundary_hop(self):
+        # 192.0.2.10 is ours, so its Received line is our own infrastructure
+        # and must not be published; the hop below it is the one being
+        # reported and is kept.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        self.assertEqual(len(received), 1)
+        self.assertIn("203.0.113.42", received[0])
+        self.assertNotIn("mx.example.org with ESMTP id abc123", received[0])
+
+    def test_the_published_hop_carries_no_envelope_recipient(self):
+        # The boundary Received line is written by OUR OWN relay, and its
+        # optional "for <addr>" clause is the envelope recipient: the
+        # victim's address, verbatim, in the one header a report reproduces
+        # in full. Truncating the chain is not enough on its own.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        self.assertNotIn("you@example.org", received[0])
+        self.assertNotIn("for <", received[0])
+        # The rest of the hop survives; this is a cut, not a blanking.
+        self.assertIn("203.0.113.42", received[0])
+
+    def test_a_forged_chain_publishes_no_hop_below_the_boundary(self):
+        # The same job test_a_forged_chain_stops_at_the_first_untrusted_hop
+        # does for sending_ip(), asserted over what actually gets published:
+        # 198.51.100.7 is an innocent party the attacker named.
+        headers = parse.report_headers(load("forged-chain.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        # Asserted in BOTH directions: dropping Received altogether would
+        # satisfy the "not published" half on its own, and a test that
+        # passes when the feature is missing protects nothing.
+        self.assertEqual(len(received), 1)
+        self.assertIn("203.0.113.99", received[0])
+        self.assertTrue(all("198.51.100.7" not in value for value in received))
+        self.assertTrue(all("198.51.100.8" not in value for value in received))
+
+
 if __name__ == "__main__":
     unittest.main()