Unlear error message parsing incorrectly formed A-R field

Bug #1704482 reported by Alexander Mohr on 2017-07-14
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Authentication-Results-Python
Medium
Unassigned

Bug Description

First I'd like to say this is a great library, thanks!

I just tried it parsing a DMARC header of an email sent from hotmail.com -> gmail.com which resulted in the following headers:

Authentication-Results: mx.google.com;
       dkim=pass <email address hidden> header.b=GNp0w69I;
       spf=pass (google.com: domain of <email address hidden> designates 40.92.5.38 as permitted sender) <email address hidden>;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hotmail.com

authentication-results: thehesiod.com; dkim=none (message not signed)
 header.d=none;thehesiod.com; dmarc=none action=none header.from=hotmail.com;

The "Authentication-Results" header parses fine, but the "authentication-results" header yields:

  File "/usr/local/lib/python3.5/site-packages/authres/core.py", line 553, in _parse_methodspec
    raise SyntaxError('Expected "="', self._parse_text)
authres.core.SyntaxError: Syntax error: Expected "=" at: ; dmarc=none action=none header.from=hot...

Alexander Mohr (thehesiod) wrote :

hmm, that hotmail authentication-results looks messed up, it has "thehesiod.com;" in there twice...not sure what to make of it

Scott Kitterman (kitterman) wrote :

The second one is not a correctly formed authentication results header field. If you look at RFC 7601 [1] paragraph 2.2 you'll see that the authserv-id only appears once. Repeating it before subsequent results is not allowed.

There could definitely be a better error message here.

[1] https://tools.ietf.org/html/rfc7601

summary: - syntax error parsing hotmail DMARC header
+ Unlear error message parsing incorrectly formed A-R field
Changed in authentication-results-python:
status: New → Triaged
importance: Undecided → Medium
Alexander Mohr (thehesiod) wrote :

hmm, any idea what generated that invalid header? I'm not sure who to log a bug against.

Scott Kitterman (kitterman) wrote :

That looks like Office 365. It's known to produce non-standard header fields like that.

Alexander Mohr (thehesiod) wrote :

K, might as well close this bug

Changed in authentication-results-python:
status: Triaged → Invalid
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers