hermes-admin/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

test(email): give the exact authserv-id pin rows a passing verdict

Browse Source 
Every topmost row carried dmarc=fail, so it failed on its verdict no
matter what the pin check did: restoring subdomain alignment on the
topmost field kept the test green (gate 2ab Low finding). The subdomain
and comment-smuggled rows now say dmarc=pass, so only the exact pin
rejects them and that mutation goes red.
This commit is contained in:
kshitijk4poor
2026-10-03 19:49:02 +05:30
committed by kshitij
parent 4fb207491e
commit e8fc41e394
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tests/gateway/test_email.py
View File

@@ -1367,13 +1367,14 @@ class TestSenderAuthentication(unittest.TestCase):
def test_only_topmost_exact_authserv_id_is_trusted(self):
"""Never search below the authoritative field or relax an authserv-id pin."""
"""Never search below the authoritative field or relax an authserv-id pin.
The subdomain and comment-smuggled rows carry dmarc=pass, so only the exact pin rejects them."""
forged_lower = "mx.ourserver.com; dmarc=pass header.from=example.com"
for topmost in (
"mx.ourserver.com; dmarc=fail header.from=example.com",
"edge.receiver.test; dmarc=fail header.from=example.com",
"child.mx.ourserver.com; dmarc=fail header.from=example.com",
"(mx.ourserver.com) edge.receiver.test; dmarc=fail header.from=example.com",
"child.mx.ourserver.com; dmarc=pass header.from=example.com",
"(mx.ourserver.com) edge.receiver.test; dmarc=pass header.from=example.com",
):
with self.subTest(topmost=topmost):
ok, reason = self._verify(