| Summary: | Scam detector is confused by links created by KMail itself | ||
|---|---|---|---|
| Product: | [Applications] kmail2 | Reporter: | Thiago Macieira <thiago> |
| Component: | message list | Assignee: | kdepim bugs <kdepim-bugs> |
| Status: | CONFIRMED --- | ||
| Severity: | normal | CC: | montel |
| Priority: | NOR | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Platform: | Other | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
|
Description
Thiago Macieira
2021-08-05 15:36:05 UTC
Thanks for bug report. I will investigate it I can file this as a separate bug report but here's another link. You'll probably get a notification from KMail that the bugzilla email is a scam too. https://www.google.com/search?q=%5C The details window will say that link points to 'https://www.google.com/search?q=/', which is incorrect. It does not. Neither the status bar nor the actual link when opened in the browser suffered the backslash-to-forwardslash transformation. You're incorrectly passing the full, decoded URL through some path clean routine (QDir::cleanPath?). There are at least two mistakes there. For the first bug it's not a scam bug it's a problem how we extract url. I need to fix it. For second one I have a patch. I need to clean it first. Git commit ee84101b36b1ea130c39a5bc9c9b3c471bb4edfb by Laurent Montel. Committed on 12/08/2021 at 17:45. Pushed by mlaurent into branch 'release/21.08'. Fix false positive for url "https://www.google.com/search?q=%5C" M +5 -2 messageviewer/src/scamdetection/autotests/scamdetectionwebenginetest.cpp M +5 -2 messageviewer/src/scamdetection/scamdetectionwebengine.cpp https://invent.kde.org/pim/messagelib/commit/ee84101b36b1ea130c39a5bc9c9b3c471bb4edfb Sorry, that can't can't be right. If you have to put the backslashes back, something went wrong before and there may be more. What were was the value of href and normalizedHref before the toDisplayString call? (In reply to Thiago Macieira from comment #5) > Sorry, that can't can't be right. If you have to put the backslashes back, > something went wrong before and there may be more. > > What were was the value of href and normalizedHref before the > toDisplayString call? "QDEBUG : ScamDetectionWebEngineTest::scamtest(scam5C) 21:01:51.884 scamdetectionwebenginetest(16715) ?[32mMessageViewer::ScamDetectionWebEngine::handleScanPage?[0m text "https://www.google.com/search?q=%5C" href "https://www.google.com/search?q=%5C" normalizedHref "https://www.google.com/search?q=%5C"" It was a bug created from a specific url found long time ago: "<a " "href=\"http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003.jpg%5CnUse\">http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003.jpg/" "nUse</a>" => I fixed it and now all autotest works. > It was a bug created from a specific url found long time ago:
> "<a "
>
> "href=\"http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003.
> jpg%5CnUse\">http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003.
> jpg/nUse</a>"
>
> => I fixed it and now all autotest works.
This one should have triggered the warning, because it isn't the same URL. You may want to do the backslash replacement only on the path component instead of the whole URL, if this case is still important.
(In reply to Thiago Macieira from comment #7) > > It was a bug created from a specific url found long time ago: > > "<a " > > > > "href=\"http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003. > > jpg%5CnUse\">http://g-ecx.images-amazon.com/images/G/01/barcodes/blank003. > > jpg/nUse</a>" > > > > => I fixed it and now all autotest works. > > This one should have triggered the warning, because it isn't the same URL. > You may want to do the backslash replacement only on the path component > instead of the whole URL, if this case is still important. yep it warns and it's ok in my patch. Perhaps I need to replace only in path component indeed. |
