#2498 new
Stacey Marshall

Mailmate is not handling modified URLs in Mail for Targeted Attack Protection consistently.

Reported by Stacey Marshall | 2020-02-21 09:52:42 UTC

Mailmate is not handling modified URLs in Mail for Targeted Attack Protection consistently.

MailMate version 1.13.1 (5671).

Targeted Attack Protection (TAP) from Proofpoint modifys emails sent to my company email:

Any emails you receive into your account from an external source will be assessed by this service to provide URL and attachment defense capability.

  • Emails containing external URLs will be rewritten to include urldefense.proofpoint.com so they can be assessed by TAP when you click on the URL.

When I click on most of these modified links I am directed to https://urldefense.com/jerror and not the page intended.

Captured the URL being sent to Firefox by

  1. Disable Choosey.app (just in case it was doing aything untoward).
  2. Enabled Logging via 'about:networking`
  3. Clicked on the URL in MailMate

When I compare the URL logged via Firefox to the link in the e-mail I find that the final dollar has been removed.

An example of a TAP modified URL, note it has final dollar character at the end.

https://urldefense.com/v3/__https://github.com/osstech-jp/openldap/commit/bba50bf6533d8f67dcbfc990b6b3161d22b4de85.patch__;!!GqivPVa7Brio!KDGhmN2slqGIqw4BFaQkTYmT7Tj8mq0aUeWtflW1P3dYJhH8Nxl7zGE_a-_SxDJKZsHI$

URL passed to firefox when clicked on has dollar removed:

https://urldefense.com/v3/__https://github.com/osstech-jp/openldap/commit/bba50bf6533d8f67dcbfc990b6b3161d22b4de85.patch__;!!GqivPVa7Brio!KDGhmN2slqGIqw4BFaQkTYmT7Tj8mq0aUeWtflW1P3dYJhH8Nxl7zGE_a-_SxDJKZsHI

Opening the email in Mail.app and clicking on the link there is a laborious workaround.

The fault does not appear to be consistent. In preparation for this ticket I sent myself a link, via external account, and that was handled correctly!

https://urldefense.com/v3/__https://staceymarshall.wordpress.com/__;!!GqivPVa7Brio!JZfEnZ9XS7DsTjRVTHm_gl6-RcqMyt3H9RvaI5HDJ2s0I4LS6g8RnnlDQzcO0bi3Dz1K$

Comments and changes to this ticket

  • Stacey Marshall

    Stacey Marshall 2020-02-21 09:57:21 UTC

    Noticed that MailMate indeed highlights the whole link in blue except for the final dollar :-)

    If I select the whole URL including the dollar and OPEN URL it opens correctly.

    • OPEN URL I have a keyboard Shortcut which opens selected text.
  • Stacey Marshall

    Stacey Marshall 2020-02-21 10:12:22 UTC

    In the test email (where the dollar was passed through) the body source looks like this:

    --000000000000838c19059f11f2cc
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: Quoted-printable

Well, why was this not converted then?

https://urldefense.com/v3/__https://staceymarshall.wordpress.com/__;!!GqivP=
Va7Brio!JZfEnZ9XS7DsTjRVTHm_gl6-RcqMyt3H9RvaI5HDJ2s0I4LS6g8RnnlDQzcO0bi3Dz1=
K$=20

--000000000000838c19059f11f2cc
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: Quoted-printable

<div dir=3D"ltr"><div>Well, why was this not converted then?</div><div><br>=
</div><div><a href=3D"https://urldefense.com/v3/__https://staceymarshall.wo=
rdpress.com/__;!!GqivPVa7Brio!JZfEnZ9XS7DsTjRVTHm_gl6-RcqMyt3H9RvaI5HDJ2s0I=
4LS6g8RnnlDQzcO0bi3Dz1K$">https://staceymarshall.wordpress.com/</a></div><d=
iv><br></div><div><br></div></div>

    While the e-mail where the links are not passed through correctly (elided a little)

    https://urldefense.com/v3/__https://github.com/osstech-jp/openldap/commit/b=
ba50bf6533d8f67dcbfc990b6b3161d22b4de85.patch__;!!GqivPVa7Brio!KDGhmN2slqGI=
qw4BFaQkTYmT7Tj8mq0aUeWtflW1P3dYJhH8Nxl7zGE_a-_SxDJKZsHI$=20
https://urldefense.com/v3/__https://github.com/osstech-jp/openldap/commit/b=
ba50bf6533d8f67dcbfc990b6b3161d22b4de85__;!!GqivPVa7Brio!KDGhmN2slqGIqw4BFa=
QkTYmT7Tj8mq0aUeWtflW1P3dYJhH8Nxl7zGE_a-_SxKwwBOjg$=20

    So maybe the one that worked has HTML while the failing one does not?

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Mac OS X email client.

Shared Ticket Bins

People watching this ticket

Tags

Pages