diff options
Diffstat (limited to 'tests/test_parse.py')
| -rw-r--r-- | tests/test_parse.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/tests/test_parse.py b/tests/test_parse.py index 49fc41e..de78b5a 100644 --- a/tests/test_parse.py +++ b/tests/test_parse.py @@ -108,6 +108,13 @@ class TestSenderDomains(unittest.TestCase): domains = parse.sender_domains(load("simple.eml")) self.assertNotIn("example.org", domains.values()) + def test_the_domain_comes_from_the_address_not_the_display_name(self): + # A display name is attacker-controlled and sits BEFORE the angle + # brackets, so a regex scanning the raw header finds it first. Doing + # that files the report against whoever the attacker named. + domains = parse.sender_domains(load("leaky.eml")) + self.assertEqual(domains["from"], "sender.example.invalid") + class TestAuthResults(unittest.TestCase): def test_verdicts_are_read_as_the_server_recorded_them(self): |