2.x: Added option to try to sanitize a modified subject if verification fails

chrome/content/options_advanced.xul

@@ -39,8 +39,11 @@
 		<preference id="pref_error.algorithm.rsa.weakKeyLength.treatAs"
 		            name="extensions.dkim_verifier.error.algorithm.rsa.weakKeyLength.treatAs"
 		            type="int"/>
+		<preference id="pref_error.sanitizeSubject"
+		            name="extensions.dkim_verifier.error.sanitizeSubject"
+		            type="bool"/>
 	</preferences>
-	
+
 	<checkbox preference="pref_debug" label="&debug.label;"/>
 	<checkbox preference="pref_error.detailedReasons" label="&error.detailedReasons.label;"/>
 	<checkbox preference="pref_error.key_testmode.ignore"
@@ -51,6 +54,8 @@
 	          label="&arh.replaceAddonResult.label;"/>
 	<checkbox preference="pref_arh.relaxedParsing"
 	          label="&arh.relaxedParsing.label;"/>
+	<checkbox preference="pref_error.sanitizeSubject"
+	          label="&error.sanitizeSubject.label;"/>
 	<hbox align="center">
 		<label>&error.illformed_i.treatAs.label;</label>
 		<menulist preference="pref_error.illformed_i.treatAs">

chrome/locale/de/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= Absender passt nicht zur Benutzeridentität
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Kopfzeile '%S' ist nicht signiert
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Der Betreff wurde verändert: '%S'

chrome/locale/de/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Tolerant">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Empfohlen">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Streng">
+
+<!ENTITY error.sanitizeSubject.label "Versuche Ergänzungen im Betreff zu korrigieren">

chrome/locale/en-US/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= From does not match the user identifier
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/en-US/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

chrome/locale/fr/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= L'expéditeur ne correspond pas avec l'identi
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/fr/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

chrome/locale/hu/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= A feladó nem egyezik a felhasználói azonos
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/hu/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

chrome/locale/it/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= Il mittente non corrisponde all’identificat
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/it/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

chrome/locale/ja-JP/dkim.properties

@@ -105,3 +105,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_AUID	= 差出人がユーザ識別子とマッチし
 
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/ja-JP/options.dtd

@@ -102,3 +102,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

chrome/locale/zh-CN/dkim.properties

@@ -100,3 +100,5 @@ DKIM_SIGWARNING_FROM_NOT_IN_SDID=From 不在签名域中
 DKIM_SIGWARNING_FROM_NOT_IN_AUID=From 不匹配用户标识符
 # DKIM_SIGWARNING - POLICY
 DKIM_SIGWARNING_UNSIGNED_HEADER = Header '%S' is not signed
+
+DKIM_SIGERROR_SUBJECT_MODIFIED	= Subject was modified: '%S'

chrome/locale/zh-CN/options.dtd

@@ -81,3 +81,5 @@
 <!ENTITY policy.unsigned_header.mode.value.0.label "Relaxed">
 <!ENTITY policy.unsigned_header.mode.value.1.label "Recommended">
 <!ENTITY policy.unsigned_header.mode.value.2.label "Strict">
+
+<!ENTITY error.sanitizeSubject.label "Try to remove amendments in the subject">

defaults/preferences/prefs.js

@@ -64,7 +64,7 @@ pref("extensions.dkim_verifier.policy.DMARC.shouldBeSigned.neededPolicy", "none"
 
 pref("extensions.dkim_verifier.display.favicon.show", true);
 
-/* 
+/*
  * Mode to handle headers, which should be signed, but are not
  * 10  relaxed
  * 20  recommended
@@ -145,7 +145,7 @@ pref("extensions.dkim_verifier.error.key_testmode.ignore", false);
 pref("extensions.dkim_verifier.error.contentTypeCharsetAddedQuotes.treatAs", 0);
 pref("extensions.dkim_verifier.error.algorithm.sign.rsa-sha1.treatAs", 1);
 pref("extensions.dkim_verifier.error.algorithm.rsa.weakKeyLength.treatAs", 2);
-
+pref("extensions.dkim_verifier.error.sanitizeSubject", false);
 
 ////////////////////////////////////////////////////////////////////////////////
 // account specific options

modules/dkimVerifier.jsm.js

@@ -1209,31 +1209,62 @@ var Verifier = (function() {
 
 		var isValid = verifyFunction(DKIMSignature.DKIMKey.p, headerHashInput, DKIMSignature.a_hash,
 			DKIMSignature.b, DKIMSignature.warnings, keyInfo);
-		if (!isValid) {
-			if (prefs.getIntPref("error.contentTypeCharsetAddedQuotes.treatAs") > 0) {
-				log.debug("Try with removed quotes in Content-Type charset.");
-				msg.headerFields.get("content-type")[0] =
-					msg.headerFields.get("content-type")[0].
-					replace(/charset="([^"]+)"/i,	"charset=$1");
+
+		if (!isValid && prefs.getIntPref("error.contentTypeCharsetAddedQuotes.treatAs") > 0) {
+			log.debug("Try with removed quotes in Content-Type charset.");
+			const contentTypeField = msg.headerFields.get("content-type")[0];
+			const sanitizedContentTypeField = contentTypeField.replace(/charset="([^"]+)"/i, "charset=$1");
+
+			if (contentTypeField !== sanitizedContentTypeField) {
+				msg.headerFields.get("content-type")[0] = sanitizedContentTypeField;
 				// Compute the input for the header hash
 				headerHashInput = computeHeaderHashInput(msg,DKIMSignature);
 				log.debug("Header hash input:\n" + headerHashInput);
 				// verify Signature
 				keyInfo = {};
 				isValid = verifyFunction(DKIMSignature.DKIMKey.p, headerHashInput,
 						DKIMSignature.a_hash, DKIMSignature.b, DKIMSignature.warnings, keyInfo);
-
-				if (!isValid) {
-					throw new DKIM_SigError("DKIM_SIGERROR_BADSIG");
-				} else if (prefs.getIntPref("error.contentTypeCharsetAddedQuotes.treatAs") === 1) {
+				if (prefs.getIntPref("error.contentTypeCharsetAddedQuotes.treatAs") === 1) {
 					DKIMSignature.warnings.push({name: "DKIM_SIGERROR_CONTENT_TYPE_CHARSET_ADDED_QUOTES"});
 					log.debug("Warning: DKIM_SIGERROR_CONTENT_TYPE_CHARSET_ADDED_QUOTES");
 				}
 			} else {
-				throw new DKIM_SigError("DKIM_SIGERROR_BADSIG");
+				log.debug("Nothing changed, no need to reverify...");
+			}
+		}
+		if (!isValid && prefs.getBoolPref("error.sanitizeSubject")) {
+			log.debug("Trying to sanitize the subject header field");
+			const subjectField = msg.headerFields.get("subject")[0];
+			const sanitizeRegexp = /(Subject:\s)(?:\*|\[).+(?:\*|\])\s(.*)/;
+			const sanitizedSubject = subjectField.replace(sanitizeRegexp, "$2").trim();
+			const sanitizedSubjectField = subjectField.replace(sanitizeRegexp, "$1$2");
+
+			if (subjectField !== sanitizedSubjectField) {
+				msg.headerFields.get("subject")[0] = sanitizedSubjectField;
+				// Compute the input for the header hash
+				headerHashInput = computeHeaderHashInput(msg,DKIMSignature);
+				log.debug("Header hash input:\n" + headerHashInput);
+				// verify Signature
+				keyInfo = {};
+				isValid = verifyFunction(DKIMSignature.DKIMKey.p, headerHashInput,
+						DKIMSignature.a_hash, DKIMSignature.b, DKIMSignature.warnings, keyInfo);
+				if (isValid) {
+					// Adding a warning, that the subject was changed
+					DKIMSignature.warnings.push({ name: "DKIM_SIGERROR_SUBJECT_MODIFIED", params: [sanitizedSubject] });
+					log.debug("Sanitized subject: " + sanitizedSubject);
+				} else {
+					// Restoring the original subject field
+					msg.headerFields.get("subject")[0] = subjectField;
+				}
+			} else {
+				log.debug("Nothing changed, no need to reverify...");
 			}
 		}
 
+		if (!isValid) {
+			throw new DKIM_SigError("DKIM_SIGERROR_BADSIG");
+		}
+
 		if (DKIMSignature.a_sig !== DKIMSignature.DKIMKey.k) {
 			throw new DKIM_SigError("DKIM_SIGERROR_KEY_MISMATCHED_K");
 		}