diff options
Diffstat (limited to 'tests/test_parse.py')
| -rw-r--r-- | tests/test_parse.py | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/tests/test_parse.py b/tests/test_parse.py index a29b7a1..49fc41e 100644 --- a/tests/test_parse.py +++ b/tests/test_parse.py @@ -63,6 +63,28 @@ class TestReceivedChain(unittest.TestCase): ) self.assertIsNone(ip) + def test_a_helo_literal_does_not_beat_the_observed_address(self): + # Postfix writes the client's own HELO string first and the address + # it actually observed second. The first is attacker-chosen. + raw = ( + b"Received: from [198.51.100.7] (unknown [203.0.113.99])" + b" by mx.example.org with ESMTP id X;" + b" Tue, 8 Sep 2026 10:00:00 +0200\r\n" + b"From: <a@evil.invalid>\r\nSubject: t\r\n\r\nbody\r\n" + ) + self.assertEqual(parse.sending_ip(raw, trusted=["192.0.2.0/24"]), + "203.0.113.99") + + def test_a_single_bracketed_address_still_works(self): + raw = ( + b"Received: from x.invalid (x.invalid [203.0.113.5])" + b" by mx.example.org with ESMTP id Y;" + b" Tue, 8 Sep 2026 10:00:00 +0200\r\n" + b"From: <a@evil.invalid>\r\nSubject: t\r\n\r\nbody\r\n" + ) + self.assertEqual(parse.sending_ip(raw, trusted=["192.0.2.0/24"]), + "203.0.113.5") + class TestSenderDomains(unittest.TestCase): def test_the_three_sender_headers_are_collected(self): |