Restaurant adım bidi marker içerdiği için rezervasyon emaillerim spoof ediliyordu (PR #611 DDD F2)

Corum Bogazkale Hitit Cad nde 49 yaslarinda "Bogazkale Hitit Mutfagi" sahibi Bahattin, 22 yillik aile restoran. Restaurant adini admin a Word brosurden 3 ay once kopyalamisti: "Bogazkale Hitit Mutfagi U+202B - Local Cuisine" (invisible RIGHT-TO-LEFT EMBEDDING marker). Sali sabahi 3 musteri "phishing email mi geldi?" sordu. Bir kadin musteri telefonunu uzatti: rezervasyon confirmation email subject **"Mutfagi - Local Cuisine" "Hitit "Bogazkale** terse donmus + "Payment required" suspicious prefix. Bahattin support a yazdi. Forensik: D1 restaurants tablo hex inspect SELECT name → "Bogazkale Hitit Mutfagi ‫- Local Cuisine" U+202B (RIGHT-TO-LEFT EMBEDDING) hyphen oncesi. Word un bilingual-title formatter otomatik direction mark inject etmis. apps/web-admin/src/lib/email/reservation.ts: `const subject = ${restaurantName} — Rezervasyon Onayi - ${customerName};` raw interpolation hicbir sanitization yok. **3 attack vector**: (1) Bidi spoofing U+202E RIGHT-TO-LEFT OVERRIDE "Restaurant U+202E ipdf.diaP" renders "Restaurant Paid.pdf!" phishing inbox; (2) CRLF injection header smuggling restaurant adı "X Bcc: attacker@evil.com" → reservation info attacker inbox leak; (3) C0 control char (Bell U+0007, Escape U+001B, DEL U+007F) terminal output spoof + log analyzer disrupt. 4 email-send code path tespit: reservation.ts + invoice-upcoming.ts + loyalty-rewards.ts + postback-failure.ts. Hepsi operator-controlled string raw interpolate. **PR #611 batch DDD F2** 2-katmanli fix: **Layer 1 sanitizePlainTextHeader helper** apps/web-admin/src/lib/email/sanitize.ts: BIDI_CHARS regex strip + CRLF \r\n → space (header smuggling kapatildi) + C0_CONTROL \u0000-\u001f + \u007f strip + trim + slice(0, maxLen=80) RFC 2822 recommendation; From-line display name 60-char guideline. **Layer 2 4 email-send path sweep**: subject + From + Reply-To header lar `sanitizePlainTextHeader(restaurantName, 80)` ile wrap. Production audit D1 restaurants hex-dump scan bidi/CRLF/C0 grep: **7 restaurant bidi marker** (Word/Google Docs paste origin), 0 CRLF, 2 trailing whitespace. Affected restaurants notice "invisible Unicode tespit sistematik temizledik, isminizin görsel hali ayni." Bahattin email subject **"Bogazkale Hitit Mutfagi - Local Cuisine — Rezervasyon Onayi - Mehmet K."** bidi stripped customer inbox normal. 1-month free Pro tier credit. Felicity York Stonegate "The Eboracum Kitchen" Roman-history themed 38-cover version ayni flow Word direction-mark origin. Pattern: **email plain-text header lar (subject, From, To, CC, BCC, Reply-To) HTML body den farkli sanitization gerektirir. HTML escape (escapeHtml) yetmez — bidi formatting marker + CRLF + C0 control char strip + length cap zorunlu. Operator-controlled string lerin (restaurant_name, affiliate_name, customer_name) email header interpolation inda her zaman sanitizePlainTextHeader helper indan gecmeli.** Implementation checklist: (1) HTML body sanitization vs plain-text header sanitization farkli (DOMPurify vs bidi+CRLF+C0+cap); (2) shared package helper tum email send code path lerine route; (3) subject + From + Reply-To header her zaman helper; (4) length cap RFC 2822 80-char subject + 60-char From-line display name; (5) production audit D1 hex-dump scan operator-controlled field bidi/CRLF/C0 grep; (6) quarterly grep audit subject.*${ helper-wrapped verify; (7) pentest restaurant_name + customer_name fields test bidi+CRLF+C0 payload + reservation email tetikle subject inspect.

İlgili makaleler