From d427f996e5248e0dcb8d6a83b8234bd12d674b98 Mon Sep 17 00:00:00 2001
From: Dylan William Hardison <dylan@hardison.net>
Date: Tue, 10 Apr 2018 17:06:26 -0400
Subject: Bug 1451416 - Bugzilla sometimes sends emails to accounts when it
 shouldn't

---
 Bugzilla/Mailer.pm | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

(limited to 'Bugzilla')

diff --git a/Bugzilla/Mailer.pm b/Bugzilla/Mailer.pm
index 1dec3d4ff..b2e87751d 100644
--- a/Bugzilla/Mailer.pm
+++ b/Bugzilla/Mailer.pm
@@ -12,8 +12,9 @@ use strict;
 use warnings;
 
 use base qw(Exporter);
-@Bugzilla::Mailer::EXPORT = qw(MessageToMTA build_thread_marker);
+our @EXPORT = qw(MessageToMTA build_thread_marker); ## no critic (Modules::ProhibitAutomaticExportation)
 
+use Bugzilla::Logging;
 use Bugzilla::Constants;
 use Bugzilla::Error;
 use Bugzilla::Hook;
@@ -25,6 +26,8 @@ use Encode qw(encode);
 use Encode::MIME::Header;
 use Email::Address;
 use Email::MIME;
+use Try::Tiny;
+
 # Return::Value 1.666002 pollutes the error log with warnings about this
 # deprecated module. We have to set NO_CLUCK = 1 before loading Email::Send
 # to disable these warnings.
@@ -62,7 +65,7 @@ sub MessageToMTA {
             $msg =~ s/(?:\015+)?\012/\015\012/msg;
         }
 
-        $email = new Email::MIME($msg);
+        $email = Email::MIME->new($msg);
     }
 
     # Ensure that we are not sending emails too quickly to recipients.
@@ -182,6 +185,20 @@ sub MessageToMTA {
     Bugzilla::Hook::process('mailer_before_send',
                             { email => $email, mailer_args => \@args });
 
+    try {
+        my $to         = $email->header('to') or die 'Unable to find "To:" address';
+        my @recipients = Email::Address->parse($to);
+        die qq{Unable to parse "To:" address - $to} unless @recipients;
+        die qq{Did not expect more than one "To:" address in $to} if @recipients > 1;
+        my $badhosts = Bugzilla::Bloomfilter->lookup("badhosts") or die "No badhosts bloomfilter";
+        if ($badhosts->test($recipients[0]->host)) {
+            WARN("Attempted to send email to address in badhosts: $to");
+            $email->header_set(to => '');
+        }
+    } catch {
+        ERROR($_);
+    };
+
     # Allow for extensions to to drop the bugmail by clearing the 'to' header
     return if $email->header('to') eq '';
 
-- 
cgit v1.2.3-24-g4f1b