1 files changed, 62 insertions, 0 deletions
diff --git a/tests/test_parse.py b/tests/test_parse.py
index 11345c7..fa3526a 100644
--- a/tests/test_parse.py
+++ b/tests/test_parse.py
@@ -290,5 +290,67 @@ class TestIocAssembly(unittest.TestCase):
         self.assertNotIn("you%40example.org", blob)
 
 
+class ReportHeaders(unittest.TestCase):
+    def test_the_whitelist_keeps_what_a_desk_needs(self):
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        names = [name for name, _ in headers]
+        for wanted in ("From", "Subject", "Date", "Message-ID", "Reply-To",
+                       "Return-Path", "Authentication-Results", "Received-SPF"):
+            self.assertIn(wanted, names)
+
+    def test_recipient_headers_never_survive_the_whitelist(self):
+        # The first property, at the one place a report reproduces header
+        # text verbatim. A blacklist would have to remember each of these;
+        # the whitelist never names them at all.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        names = [name for name, _ in headers]
+        blob = repr(headers)
+        for name in ("To", "Cc", "Delivered-To", "X-Original-To"):
+            self.assertNotIn(name, names)
+        self.assertNotIn("victim@example.org", blob)
+        self.assertNotIn("colleague@example.org", blob)
+
+    def test_received_stops_at_the_boundary_hop(self):
+        # 192.0.2.10 is ours, so its Received line is our own infrastructure
+        # and must not be published; the hop below it is the one being
+        # reported and is kept.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        self.assertEqual(len(received), 1)
+        self.assertIn("203.0.113.42", received[0])
+        self.assertNotIn("mx.example.org with ESMTP id abc123", received[0])
+
+    def test_the_published_hop_carries_no_envelope_recipient(self):
+        # The boundary Received line is written by OUR OWN relay, and its
+        # optional "for <addr>" clause is the envelope recipient: the
+        # victim's address, verbatim, in the one header a report reproduces
+        # in full. Truncating the chain is not enough on its own.
+        headers = parse.report_headers(load("reportable.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        self.assertNotIn("you@example.org", received[0])
+        self.assertNotIn("for <", received[0])
+        # The rest of the hop survives; this is a cut, not a blanking.
+        self.assertIn("203.0.113.42", received[0])
+
+    def test_a_forged_chain_publishes_no_hop_below_the_boundary(self):
+        # The same job test_a_forged_chain_stops_at_the_first_untrusted_hop
+        # does for sending_ip(), asserted over what actually gets published:
+        # 198.51.100.7 is an innocent party the attacker named.
+        headers = parse.report_headers(load("forged-chain.eml"),
+                                       trusted=["192.0.2.0/24"])
+        received = [value for name, value in headers if name == "Received"]
+        # Asserted in BOTH directions: dropping Received altogether would
+        # satisfy the "not published" half on its own, and a test that
+        # passes when the feature is missing protects nothing.
+        self.assertEqual(len(received), 1)
+        self.assertIn("203.0.113.99", received[0])
+        self.assertTrue(all("198.51.100.7" not in value for value in received))
+        self.assertTrue(all("198.51.100.8" not in value for value in received))
+
+
 if __name__ == "__main__":
     unittest.main()