TLD (.com) appended to "undefined" hosts, causing URIBL_BLACK to trigger

[stefan-popescu]

We found that all emails from a fintech company were triggering SpamAssassin's URIBL_BLACK. We reviewed the email content and checked every single URI, but none were listed at https://uribl.com

Upon further investigation, we found that references to an "undefined" URL in their email code were causing the false-positives by triggering URIBL_BLACK for undefined.com, which at the time of our investigation was blacklisted at https://uribl.com . Here's the exact code causing the false positive:

Here's the URIBL_BLACK rule being triggered:

We've contacted URIBL and they've suggested that our scanner software has to be appending a .COM to host parts that don't have a TLD. To mitigate this issue, they have delisted undefined.com in the meantime, so it may no longer be possible to reproduce this issue exactly.

We have reported this issue to ConfigServer (because we're using MailScanner Front-End), but they believe it could be related to MailScanner, reason why I'm reporting this as a possible bug here.

To Reproduce
Steps to reproduce the behavior:

1. Send an email with a static element that links to http:undefined.
2. Check the MailScanner SpamCheck header if URIBL_BLACK was triggered.

Note: Since URIBL have delisted undefined.com from their database, this issue will no longer be reproduceable for undefined. A different word of which .COM domain is blacklisted would be necessary. Maybe one from this page? https://uribl.com/gold.shtml

We're not 100% sure if this issue is related to MailScanner, but it was the last possible point of failure in our investigation.

Thank you for your attention.

[github-actions]

Thank you for submitting your first issue to MailScanner! We will respond to you soon!

[Skywalker-11]

http:undefined is not a valid css URL as http is a special URL that requires to be followed by ://.
An url to an invalid resource should per css standard contain an empty URL url("") instead.

So the sender should have made their mails standard conform 😉

I was going to flag this as a bug then immediately realized that that message is being passed from MailScanner to SpamAssassin as-is. MailScanner is not modifying the url prior to feeding the message to SpamAssassin.