[BUG] Error parsing and getting mails

[informaticaeloy]

[BUG] Error parsing and getting mails

[majo053]

Hello, this is problem with encoding email header From:

You can fix it:

Change file list_emails.py to this:

            msg = email.message_from_bytes(message)
            decode = email.header.decode_header(msg['From'])
            from_field = ""
            for decode_item in decode:
                    if decode_item[1] is not None:
                            from_field += decode_item[0].decode(decode_item[1])
                    else:

                            if isinstance(decode_item[0], bytes):
                                    from_field += decode_item[0].decode()

                            else:
                                    from_field += str(decode_item[0])

Change file case_from_email.py to this:

            msg = email.message_from_bytes(message)
            decode = email.header.decode_header(msg['From'])
            external_from_field = ""
            for decode_item in decode:
                    if decode_item[1] is not None:
                            external_from_field += decode_item[0].decode(decode_item[1])
                    else:

                            if (isinstance(decode_item[0], bytes)):
                                    external_from_field += decode_item[0].decode()

                            else:
                                    external_from_field += str(decode_item[0])
            parsed_from_field = email.utils.parseaddr(external_from_field)
            if len(parsed_from_field) > 1:
                    external_from_field = parsed_from_field[1]

@emalderson Can you please update this files?

[emalderson]

Hello, sorry for the late reply but i'm very busy lately.
Anyway, thank you for providing the code to fix the bug that you encountered, but the problem with that part of code is that when you "fix" one thing, you can easily break 100 other things. What I mean is that if I blindly added your fix to the code, I may break the parsing logic for many other emails in which the from field has different properties. I need to test the change on all the emails that I have and then I'll consider adding your code and mention you for the contribution.

[tiagotsi]

Does anyone have a working image of ThePhish in .OVF? I am not able to install by Docker and Docker compose.

[LoriSchochWIT]

Hello, is there an update for this issue?
Or can anybody provide a solution on how to implement the suggested code from @majo053? I don't understand which lines to replace exactly.
Thanks in advance!

[LoriSchochWIT]

Hi, is there still no working solution that can be implemented? @emalderson

[emalderson]

Hello. Unfortunately, errors like these need a thorough testing process. Those are infact related to the absurdly big number of ways in which an email can be encoded into the MIME multipart format. I managed to cover the most widespread use cases, but I cannot predict how every email client encodes the emails. This means that the fields that ThePhish needs to extract are not located in any of the fields that I search in programmatically, so the code breaks. Plus, there may also be some issues with chinese or japanese characters.

This same error is also mentioned in issue #40.

Moreover, the code provided by majo053 does not fix the problem, since the problem highlighted here is related to the encoding and decoding of the HTML part in the email.