You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@spamassassin.apache.org on 2023/01/22 02:34:18 UTC

[Bug 8110] New: DecodeShortURLs should offer per-shortener setting to override UA

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

            Bug ID: 8110
           Summary: DecodeShortURLs should offer per-shortener setting to
                    override UA
           Product: Spamassassin
           Version: 4.0.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Plugins
          Assignee: dev@spamassassin.apache.org
          Reporter: dilldall@bjork.org
  Target Milestone: Undefined

The default UA in DecodeShortURLs tries to emulate a browser, which for many
redirectors is necessary. However, for certain redirectors this causes an
undesired change in behavior.

Compare (using URL found in spam, originally leading to a phishing page):

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64 ;x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/101.0.4951.67 Safari/537.36)" -I https://t.co/QXabAdmraO

This uses the default UA, and results in a 200, with a meta refresh in the
body. No trouble for a browser, but trouble for us.

But when using a non-browser (or at least specifically a "curl/n.nn.n") UA:

curl -I https://t.co/QXabAdmraO

You get a 301 with a location header, which works fine.

To get around this, there could be a config setting to override UA on a
per-shortener basis, the same way url_shortener_get lets you override method.
For maximum flexibility, this could even be a string input, so you could set an
entirely custom UA for an individual shortener.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 8110] DecodeShortURLs should offer per-shortener setting to override UA

Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

Giovanni Bechis <gi...@paclan.it> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
                 CC|                            |giovanni@paclan.it

--- Comment #4 from Giovanni Bechis <gi...@paclan.it> ---
Committed a similar patch in r1921527.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 8110] DecodeShortURLs should offer per-shortener setting to override UA

Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

--- Comment #3 from Giovanni Bechis <gi...@paclan.it> ---
Created attachment 5972
  --> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5972&action=edit
custom User-Agent

Proposed patch to set a custom User-Agent

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 8110] DecodeShortURLs should offer per-shortener setting to override UA

Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

Sidney Markowitz <si...@sidney.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sidney@sidney.com

--- Comment #2 from Sidney Markowitz <si...@sidney.com> ---
*** Bug 8114 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 8110] DecodeShortURLs should offer per-shortener setting to override UA

Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

--- Comment #1 from Christer Mjellem Strand <di...@bjork.org> ---
See also somewhat related bug #8111. Addressing either should be sufficient to
make t.co work, though if having to pick one, this would probably be the
cleaner (and likely easier) approach. OTOH, the other would fix any such broken
shorteners out of the gate, whereas this would require further config for each
of them.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 8110] DecodeShortURLs should offer per-shortener setting to override UA

Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8110

Christer Mjellem Strand <di...@bjork.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dilldall@bjork.org
           Priority|P2                          |P4

-- 
You are receiving this mail because:
You are the assignee for the bug.