fix: prevent sender whitelist spoofing by matching only the parsed email address
linuztx committed
Mar 17, 2026 at 23:51 UTC
c1119c9d93cb15a9f1693a82d0c49247ad607adb
1 file changed
+6
-1
plugins/_email_integration/helpers/imap_client.py
+6
-1
@@ -442,7 +442,12 @@ def _is_noreply(sender: str) -> bool:
442
443
444
def _matches_whitelist(sender: str, whitelist: list[str]) -> bool:
445
- sender_lower = sender.lower()
445
+ addr = sender
446
+ match = re.search(r"<([^>]+)>", sender)
447
+ if match:
448
+ addr = match.group(1).strip()
449
+
450
+ sender_lower = addr.lower()
451
for pattern in whitelist:
452
if fnmatch(sender_lower, pattern.lower()):
453
return True