NotificationsYou must be signed in to change notification settings
Fork9.6k
Star30.3k

[Mailer][Mime] Refactor S/MIME encryption handling in`SMimeEncryptionListener`#59831

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

fabpot merged 1 commit intosymfony:7.3fromSpomky:fix-smime-encryption-listener

Mar 26, 2025

Merged

[Mailer][Mime] Refactor S/MIME encryption handling in`SMimeEncryptionListener`#59831

fabpot merged 1 commit intosymfony:7.3fromSpomky:fix-smime-encryption-listener

Mar 26, 2025

Conversation

Copy link

Contributor

Spomky commentedFeb 21, 2025•
edited
Loading

Q	A
Branch?	7.3
Bug fix?	yes
New feature?	yes
Deprecations?	no
Issues
License	MIT

It appears that the smime_encrypter introduced in#58501 is incorrect, as the email is encrypted only for the sender instead of being encrypted per recipient.
This PR introduces a newSmimeCertificateRepositoryInterface, responsible for retrieving recipient certificates.

An email is encrypted under the following conditions:

A certificate is found for all recipients.
The custom headerX-SMime-Encrypt is present.
If either of these conditions is not met, the email is sent unencrypted.

Example of usage:

<?phpnamespaceApp\Security;useSymfony\Component\DependencyInjection\Attribute\Autowire;useSymfony\Component\Mailer\EventListener\SmimeCertificateRepositoryInterface;class LocalFileCertificateRepositoryimplements SmimeCertificateRepositoryInterface{publicfunction__construct(        #[Autowire(param:'kernel.project_dir')]privatereadonlystring$projectDir    ){}publicfunctionfindCertificatePathFor(string$email): ?string    {$hash =hash('sha256',strtolower(trim($email)));$path =sprintf('%s/storage/%s.crt',$this->projectDir,$hash);returnfile_exists($path) ?$path :null;    }}

carsonbot added Status: Needs Review Bug Feature labels

Feb 21, 2025

carsonbot added this to the7.3 milestone

Feb 21, 2025

Spomky force-pushed thefix-smime-encryption-listener branch 2 times, most recently fromc3a8318 toeb8e560Compare

February 21, 2025 15:31

stof reviewed

Feb 21, 2025

View reviewed changes

src/Symfony/Component/Mailer/SMimeRecipient.php OutdatedShow resolvedHide resolved

src/Symfony/Component/Mailer/EventListener/SmimeEncryptedMessageListener.php OutdatedShow resolvedHide resolved

src/Symfony/Component/Mailer/SMimeRecipient.php OutdatedShow resolvedHide resolved

OskarStark added Mime Mailer labels

Feb 21, 2025

carsonbot changed the title~~Refactor S/MIME encryption handling in Mailer SMimeEncryptionListener~~[Mailer][Mime] Refactor S/MIME encryption handling in Mailer SMimeEncryptionListener

Feb 21, 2025

Spomky force-pushed thefix-smime-encryption-listener branch 4 times, most recently from204c36f to6499c8aCompare

February 21, 2025 16:16

Spomky changed the title~~[Mailer][Mime] Refactor S/MIME encryption handling in Mailer SMimeEncryptionListener~~[Mailer] Refactor S/MIME encryption handling in Mailer SMimeEncryptionListener

Feb 21, 2025

Refactor S/MIME encrypter to use certificate repository

7c76c54

Replaces direct certificate path usage with a repository interface for managing S/MIME certificates. This improves flexibility by allowing custom certificate retrieval logic through `SmimeCertificateRepositoryInterface`. Adjusted related tests, configuration, and event listener implementation accordingly.

Spomky force-pushed thefix-smime-encryption-listener branch from6499c8a to7c76c54Compare

February 21, 2025 16:40

Copy link

ContributorAuthor

Spomky commentedFeb 22, 2025•
edited
Loading

It is important to mention in the documentation that caution should be exercised when sending encrypted emails to multiple recipients. And indeed, all recipients are used here and therefore the main recipients as well as those in BCC. It is therefore possible to know these recipients depending on the encryption method used.

Spomky requested a review fromstof

March 2, 2025 11:06

fabpot reviewed

Mar 3, 2025

View reviewed changes

src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

		@@ -2314,8 +2314,8 @@ private function addMailerSection(ArrayNodeDefinition $rootNode, callable $enabl
		->canBeEnabled()
		->info('S/MIME encrypter configuration')
		->children()
		->scalarNode('certificate')
		->info('Path to certificate (in PEM format without the `file://` prefix)')
		->scalarNode('repository')

Copy link

Member

fabpotMar 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

For reviewers, this change is fine as this feature has been introduced in 7.3, so not yet released

OskarStark changed the title~~[Mailer] Refactor S/MIME encryption handling in Mailer SMimeEncryptionListener~~[Mailer] Refactor S/MIME encryption handling inSMimeEncryptionListener

Mar 3, 2025

fabpot approved these changes

Mar 26, 2025

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels

Mar 26, 2025

carsonbot changed the title~~[Mailer] Refactor S/MIME encryption handling inSMimeEncryptionListener~~[Mailer][Mime] Refactor S/MIME encryption handling inSMimeEncryptionListener

Mar 26, 2025