security(v2.12): strictly parse exactly one IMAP From mailbox before sender-whitelist checks #129

New issue

Open

opened 2026-09-09 14:58:54 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-09 14:58:54 +00:00

Owner

Upstream

Agent Zero v2.12 security fix: https://github.com/agent0ai/agent-zero/releases/tag/v2.12

Confirmed gap on main

plugins/_email_integration/helpers/imap_client.py decodes the raw From header into a string and then extracts/matches an address for the sender whitelist. v2.12 hardens this boundary by requiring exactly one valid mailbox before whitelist evaluation.

Required work

Parse the RFC mailbox structure using the standard email/address parsing facilities rather than regex/string extraction over the decoded header.
Require exactly one valid From mailbox.
Reject zero-address, multi-address, malformed, ambiguous, group/list, or parser-error From values before whitelist checks.
Normalize the parsed addr-spec consistently for exact/wildcard whitelist matching.
Keep display-name text separate from the authenticated/authorized mailbox identity.
Apply the same invariant to every IMAP path that feeds agent-visible inbound mail.

Acceptance

From: Alice <alice@example.com> matches as alice@example.com.
Multiple mailboxes in From are rejected even when one is whitelisted.
Crafted display names cannot smuggle a whitelisted address past the parser.
Empty/malformed/group forms fail closed.
Existing wildcard whitelist semantics operate on the single parsed addr-spec only.
Regression tests include ambiguous/multi-address headers and valid international/display-name cases.

## Upstream Agent Zero v2.12 security fix: https://github.com/agent0ai/agent-zero/releases/tag/v2.12 ## Confirmed gap on main `plugins/_email_integration/helpers/imap_client.py` decodes the raw `From` header into a string and then extracts/matches an address for the sender whitelist. v2.12 hardens this boundary by requiring exactly one valid mailbox before whitelist evaluation. ## Required work - Parse the RFC mailbox structure using the standard email/address parsing facilities rather than regex/string extraction over the decoded header. - Require exactly one valid `From` mailbox. - Reject zero-address, multi-address, malformed, ambiguous, group/list, or parser-error `From` values before whitelist checks. - Normalize the parsed addr-spec consistently for exact/wildcard whitelist matching. - Keep display-name text separate from the authenticated/authorized mailbox identity. - Apply the same invariant to every IMAP path that feeds agent-visible inbound mail. ## Acceptance - `From: Alice <alice@example.com>` matches as `alice@example.com`. - Multiple mailboxes in `From` are rejected even when one is whitelisted. - Crafted display names cannot smuggle a whitelisted address past the parser. - Empty/malformed/group forms fail closed. - Existing wildcard whitelist semantics operate on the single parsed addr-spec only. - Regression tests include ambiguous/multi-address headers and valid international/display-name cases.