Closed (fixed)
Project:
Postmark Webhooks
Version:
1.0.0-alpha1
Component:
Code
Priority:
Major
Category:
Bug report
Assigned:
Reporter:
Created:
6 Sep 2026 at 02:15 UTC
Updated:
20 Sep 2026 at 14:40 UTC
Jump to comment: Most recent
Problem/Motivation
mail_alter passes a comma-separated To list to a single-address lookup. The display-name regex extracts only the first bracketed address. Suppressed recipients later in the list can receive mail; Cc and Bcc are not examined.
Evidence and scope
Reviewed 1.0.0-alpha1, source commit 02fd9d36af5237e712cecb7155d79725f7824880. Location: postmark_webhooks.module:22.
Kernel reproduction: safe@example.com, x@example.com remains send=TRUE after a hard bounce for x@example.com. Display-name and Cc/Bcc gaps are confirmed by code, not transport-level tests.
Proposed resolution
Use a supported mailbox parser and explicitly define behavior when a message contains both allowed and suppressed recipients. For the core hook, blocking the whole message may be the safest initial contract; do not silently rewrite visible recipients without specifying semantics.
Acceptance criteria
Cover mixed case, quoted names containing commas, multiple bracketed addresses, To/Cc/Bcc and malformed addresses. Verify actual core mail-manager behavior and preserve send=FALSE set by another module.
Comments
Comment #2
jmcerdaImplemented recipient parsing and whole-message suppression across To, Cc and Bcc, including quoted names, multiple addresses and header arrays. Malformed lists fail closed, and prior cancellation is retained. Real Drupal mail-manager tests prove suppressed mail never reaches the test transport and allowed mail preserves its headers. Drupal 10/11 tests and coding standards pass; review findings have been addressed. Integration and release remain pending.
Comment #3
jmcerdaThe validation and durable-suppression prerequisite is now integrated in public 1.x at d3c5d94. The every-recipient change has been refreshed against that merged branch and remains under integration review.
Both PostgreSQL CI matrices, Drupal 10.3/PHP 8.3 and Drupal 11/PHP 8.4, pass 41 tests and 249 assertions. The local Drupal 11/PHP 8.4 suite passes with the same counts. Mail-manager tests prove suppressed To/Cc/Bcc recipients never reach the test transport, allowed mail remains unchanged, malformed lists fail closed, and earlier cancellation is preserved. Drupal/DrupalPractice coding standards pass; no real mail was sent.
Earlier review findings remain fixed and resolved. The automated review service failed to run; fallback findings review completed with no outstanding findings. This every-recipient change is not yet merged, tagged or deployed. Native Symfony Mailer remains a separate optional-adapter issue.
Comment #10
jmcerdaIntegrated into 1.x at d4f8460 after review. The merged development branch was mirrored additively to the public source repository.
The reviewed head passed PostgreSQL CI on Drupal 10.3/PHP 8.3 and Drupal 11/PHP 8.4 (41 tests, 249 assertions each), including real mail-manager checks for To/Cc/Bcc suppression, malformed lists, unchanged allowed mail and prior cancellation. Drupal/DrupalPractice coding standards pass. All review findings are resolved; the automated review service failed to run and fallback findings review completed without outstanding findings.
Fixed on the development branch only. No release tag or deployment was made, and no production mail was sent. Native Symfony Mailer support remains a separate optional-adapter issue.
Comment #13
jmcerdaIntegrated into the 1.x development branch and included in 1.0.0-alpha2. The release tag and branch are mirrored to Drupalcode. The six-job Drupal 10/11 and Mailer Plus integration matrix passes. See the release notes for database updates and retained-history limitations. This records module publication; site deployment is a separate operation.