postalserver / postalserver/postal

Messages passed from remote server to `deliveries.output` are not sanitized

Open
#3,592 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Ruby
Stars
16.8k
Forks
1.3k
Avg merge
13d 7h
Merged PRs (30d)
2

Description

## Describe the bug

Started seeing the following issue in periods in Sentry:

```
internal error: Mysql2::Error: Incorrect string value: '\xD3\xCA\xCF\xE4\xB2\xBB...' for column `postal-server-123`.`deliveries`.`output` at row 1
```

When I checked the specific message in the GUI, I see that it's being logged as an Error, instead of a hard fail. The trigger for this is someone misspelling their email address as GNAIL instead of GMAIL. `gnail.com` actually has a proper MX, a Chinese one, which returns "mailbox does not exist" in English and Chinese.

The Chinese characters are not considered to be valid characters.

## To Reproduce

Just send a test email to someone@gnail.com

## Expected behaviour

A proper hard fail with mailbox does not exist, no retries. I tried telnetting, the remote server does return a 550.

## Environment

Postal 3.3.7 docker on a Debian 12 host.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how remote SMTP responses are handled before being written to deliveries.output, using the Mysql2 encoding error and the gnail.com reproduction as entry points. Verify the response is safely stored and that a remote 550 mailbox failure is reported as a hard failure without retries.

Written by the indexing model from the issue text.

Assessment

Tech stack
mysql, ruby
Domain
backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.