It looks like phabricator doesn't make use of "Sender" in phpmailerlite when sending mails as a different user - this leads to the problems described in send-as-user. Setting "Sender" (and thus the MAIL FROM field) to a single known entity while still setting "From" to the user should fix those problems.
Description
Description
Related Objects
Related Objects
- Mentioned In
- T12046: PHPMailer RCE [CVE-2016-10033 and CVE-2016-10045]
T11921: Set mail sender name as "<User> via <Configurable name>".
T7746: Phacility mail is going to "Spam" for some Gmail users - Mentioned Here
- T12046: PHPMailer RCE [CVE-2016-10033 and CVE-2016-10045]
T8724: Add List-Id field to emails to mailing lists, otherwise most mail programs will reject the email when sent as-user
Event Timeline
Comment Actions
This is worth pursuing since it could reduce configuration complexity and allow us to pick better defaults, but requires some finesse to implement and test; SendGrid does not allow us to specify a separate Sender and SES may or may not.
I also worry we may run into deliverability issues:
The vast majority of SPF implementations today use the return-path as the subject of authentication and do not get involved with the header "From:".
http://www.openspf.org/FAQ/Envelope_from_scope
Does "vast majority" mean "99.99999%" or "98%"?
This (random internet answer) suggests the opposite, although there's little reason to believe it is accurate since it doesn't discuss Return-Path:
Most mail servers with SPF checking will be checking just the From: header, they won't care about the Sender header.
http://serverfault.com/questions/218643/correct-use-of-smtp-sender-header/218756#218756
My guess is that we won't hit deliverability issues, but it's really hard to verify and debug if 1-2% of mail fails to arrive.
The short term approach to this might be to add more configuration, e.g. a flag which sets Sender to a well-known address if possible for the adapter. Then you could run with that and see if you hit issues.
Comment Actions
Any SPF implementation that uses the "From:" header and not the envelope will already fail in a number of typical use cases:
- BCC
- mailing lists
Especially the second is common enough that people do care if it gets broken. As such I don't think there are likely to be any issues.
Comment Actions
T8724 has an implementation idea on how to fix this. Would there be interest in a full patch?
Comment Actions
Note that there is a Sender-related RCE in PHPMailer until Dec 2016, see T12046 for discussion.
Comment Actions
Not clear that "Sender" is worth pursuing, even if it does give us more flexibility around configuring the "From" header in some cases.