[tor-bugs] #33835 [Circumvention/BridgeDB]: Gmail's quoted response confuses BridgeDB's email autoresponder

[Tor Bug Tracker & Wiki]

#33835: Gmail's quoted response confuses BridgeDB's email autoresponder
----------------------------------------+-----------------------
     Reporter:  phw                     |      Owner:  (none)
         Type:  defect                  |     Status:  new
     Priority:  Medium                  |  Milestone:
    Component:  Circumvention/BridgeDB  |    Version:
     Severity:  Normal                  |   Keywords:  s30-o22a2
Actual Points:                          |  Parent ID:  #31279
       Points:  1                       |   Reviewer:
      Sponsor:  Sponsor30-can           |
----------------------------------------+-----------------------
 When replying to a BridgeDB email in Gmail's web interface, one ends up
 sending an email like this:
 {{{
 On Mon, Apr 6, 2020 at 2:12 PM <bridges at torproject.org> wrote:

 >
 > [This is an automated email.  Please do not reply.]
 >
 > Here are your bridges:
 >
 >   [redacted]
 >
 > Add these bridges to your Tor Browser by opening your browser
 > preferences, clicking on "Tor", and then adding them to the "Provide a
 > bridge" field.
 >
 > If these bridges are not what you need, reply to this email with one of
 > the following commands in the message body:
 >
 >   get bridges            (Request unobfuscated Tor bridges.)
 >   get ipv6               (Request IPv6 bridges.)
 >   get transport TYPE     (Request obfuscated bridges. Replace TYPE with
 > 'obfs4'.)
 >   get key                (Get a copy of BridgeDB's public GnuPG key.)
 >
 >
 >

 --000000000000dde1a205a2a60f3e
 Content-Type: text/html; charset="UTF-8"
 Content-Transfer-Encoding: quoted-printable

 <div dir=3D"ltr">get transport obfs4<br></div><br><div
 class=3D"gmail_quote=
 "><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Apr 6, 2020 at 2:12 PM
 <=
 <a href=3D"mailto:bridges at torproject.org">bridges at torproject.org</a>>
 wr=
 ote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px
 0px=
  0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
 [This is an automated email.=C2=A0 Please do not reply.]<br>
 <br>
 Here are your bridges:<br>
 <br>
 =C2=A0 [redacted]<br>
 <br>
 Add these bridges to your Tor Browser by opening your browser<br>
 preferences, clicking on "Tor", and then adding them to the
 &quot=
 ;Provide a<br>
 bridge" field.<br>
 <br>
 If these bridges are not what you need, reply to this email with one
 of<br>
 the following commands in the message body:<br>
 <br>
 =C2=A0 get bridges=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (Request
 unobfu=
 scated Tor bridges.)<br>
 =C2=A0 get ipv6=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0
 =C2=A0(Requ=
 est IPv6 bridges.)<br>
 =C2=A0 get transport TYPE=C2=A0 =C2=A0 =C2=A0(Request obfuscated bridges.
 R=
 eplace TYPE with 'obfs4'.)<br>
 =C2=A0 get key=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (Get
 =
 a copy of BridgeDB's public GnuPG key.)<br>
 <br>
 <br>
 </blockquote></div>

 --000000000000dde1a205a2a60f3e--
 }}}

 BridgeDB correctly ignores the commands that start with `>` but it doesn't
 ignore the commands that are encoded in quoted-printable. BridgeDB's email
 parser ends up
 [https://gitweb.torproject.org/bridgedb.git/tree/bridgedb/distributors/email/request.py?h=develop&id=bca64964a255cf959489c7049c66e5eb70b5291c#n87
 interpreting each line as command], ending in "get key", which raises an
 exception, resulting in BridgeDB sending no response at all.

 We should make sure that BridgeDB doesn't get confused by Gmail's quoted-
 printable response.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33835>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online