The Bounce module is very helpful!
I hit a problem when analyze mail like this:

Delivered-To: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Received: by xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx with SMTP id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;
        Thu, 4 Dec 2014 03:06:28 -0800 (PST)
X-Received: by xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx with SMTP id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;
        Thu, 04 Dec 2014 03:06:28 -0800 (PST)
Return-Path: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Received: from xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. [xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx])
        by mx.google.com with SMTP id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        for <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>;
        Thu, 04 Dec 2014 03:06:28 -0800 (PST)
Received-SPF: pass (google.com: domain of xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx designates xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx as permitted sender) client-ip=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;
Authentication-Results: mx.google.com;
Received: from mail-la0-f43.google.com ([xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]) (using TLSv1) 
	ID xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; Thu, 04 Dec 2014 03:06:28 PST
Received: by xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx with SMTP id xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        for <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>; Thu, 04 Dec 2014 03:06:27 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
X-Gm-Message-State: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxpvbvPjWTGQ==
X-Received: by 10.112.139.196 with SMTP id ra4mr8837716lbb.95.1417691187306;
        Thu, 04 Dec 2014 03:06:27 -0800 (PST)
X-Received: by 10.112.139.196 with SMTP id ra4mr8837702lbb.95.1417691187181;
        Thu, 04 Dec 2014 03:06:27 -0800 (PST)
To: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
From: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Date: Thu, 4 Dec 2014 03:06:27 -0800
Message-ID: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
Subject: I'm out of the office today
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
Content-Disposition: inline
Precedence: bulk
X-Autoreply: yes
Auto-Submitted: auto-replied

PGRpdiBkaXI9Imx0ciI+S0K

The content is encoded, however, the mail properties are not. Therefore when I try to analyze such a mail, the callstack looks like,

  • bounce_connect in bounce.conector.inc
  • getMessage in bounce.conector.class.inc
  • mailGetParts in bounce.conector.class.inc
  • mailDecodePart in bounce.conector.class.inc

From the code, it's quite obvious that 'getMessage' is used only for get mail basic properties, and therefore no need to decode those properties.

I added a patch to remove the decode process for function 'mailDecodePart' to solve the analysis failure.

I'm not sure this change is proper or not, thanks

CommentFileSizeAuthor
#1 bounce.diff856 bytesLang Wu Jane

Comments

Lang Wu Jane’s picture

StatusFileSize
new856 bytes