Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify email informaton prior to sending #3553

Open
honeybadger bot opened this issue Jun 3, 2024 · 0 comments
Open

Verify email informaton prior to sending #3553

honeybadger bot opened this issue Jun 3, 2024 · 0 comments

Comments

@honeybadger
Copy link

honeybadger bot commented Jun 3, 2024

The HelpsController allows non-logged in users to send a help email, and the required attribute on form elements ensures that the email is supplied.

However we've had a case where a bot discovered the form and submitted it, which generated a bunch of HelpsMailer Sidekiq jobs which failed, because the From address was not supplied (taken from the email input element).

Perhaps the controller should verify the input before sending off the email job?

Here's an example of a Honeybadger notification:

https://app.honeybadger.io/projects/77112/faults/108352644

And the non-Shibboleth request that generated it:

66.94.113.176 - "" [02/Jun/2024:17:51:05 -0700] "POST /help HTTP/1.1" 200 327 "https://sdr.stanford.edu/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36"

Other request activity from that IP address makes it clear that it was a bot probing for vulnerabilities.

@edsu edsu changed the title [happy-heron/prod] ArgumentError: SMTP From address may not be blank: nil Verify email informaton prior to sending Jun 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

0 participants