inbound email parser accepts any "to" recipient shape and can create junk itinerary items #15
Labels
No labels
blocked:needs-decision
bug
chore
in-progress
security/high
security/medium
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
AuWoMe/planish#15
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
src/app/api/inbound/resend/route.ts: toEmail is taken as-is (array first element or string) and matched against trips.forwardEmail with no normalization (case, whitespace, display-name wrappers like "Trip abc <trip-xxxx@inbound...>"). A display-name-wrapped To header therefore 404s valid mail. parseEmailContent also always returns at least one item (type defaults to note) with the raw subject as title, so a completely unrelated email forwarded by mistake creates a junk itinerary item instead of staying needs_review.