Spam due to thunderbird extension adding "script" to html source?

After struggling with some increased SPAM scoring on emails sent, I think the problem was related to LT extension for thunderbird adding a:

<script data-cookieconsent="ignore" src="moz-extension://8225a48f-40fb-495c-bc27-bf22a87dc655/content/executor.js"></script>

to my html source code.

I had to disable extension one by one and performed tests with mail-tester.com
Scripts within html always increase spam scoring so if this is truly caused by the extension is a major reason not to use it.

The issue has already been fixed in our code in version 6.2.7, but we are waiting for Thunderbird to review the update for the store (Grammar and Spell Checker — LanguageTool :: Add-ons for Thunderbird).

1 Like

Version 6.2.7 is now online, the issue should be solved after an update.

I must inform you that this behavior has returned in the latest builds. I’m not exactly sure in which version it specifically started, as it may have begun in a previous version without me noticing. However, the fact is that this behavior is present in the current version (v8.11.2). I noticed it after receiving some negative anti-spam scores, which I had never received before.

Thanks for the report. Which version of TB do you use? I just tried to reproduce the issue with TB 128, but all I see is <lt-container></lt-container> in the HTML, no <script>.

I was using version 128.2.1esr (64-bit) on Windows 10 when I sent and inspected the emails containing the <script> tags. I have just updated my Thunderbird to version 128.2.3esr with the intention of testing again, but apparently the extension is inactive, so I couldn’t test it in this version.

We’ve configured the add-on to be compatible with TB up to and incl. version 130, not sure why it should be inactive.

Do you use any other add-ons in parallel? Anything else that could help us reproduce the issue, e.g. does it also happen if you send a simple 1-sentence email?

I expressed myself poorly, let me rephrase. The extension is actually active, it appears in the top right corner of the editor. However, at the moment, it is not checking the text I’m typing. The icon that used to appear in the bottom right corner, showing whether there were errors in the text, is no longer visible. In other words, while the extension is active, it is not checking the text.

Additionally, I noticed that not even the <lt-container> tags, which used to be inserted, are present in the email body anymore. Similarly, the <script> tags, which previously appeared, are no longer included either. Therefore, although the extension is still active, it clearly stopped working as expected. Interestingly, this malfunction occurred right after my first post.

That’s strange, it works for me using 128.2.3esr, i.e. the text gets checked and errors get underlined. Do you have other add-ons running?

That’s crazy, this is very strange. The only extension installed is LT. I also just turned on my secondary computer, which I use occasionally, and it still has version 128.2.0esr of Thunderbird with the latest version of LT. However, the extension is also not checking the text, even though this machine had no issues before, as I used it recently. Very bizarre. Could it be something related to the connection? I don’t think so, since the browser extension is working and checking the text. I even changed ISPs, but the issue persists. Anyway, I’ll wait and see if there’s any update. I don’t want to flood this topic with this issue, as the main concern here is about the <script> tags. When the extension starts working again, I’ll run new tests regarding that.

I compared my advanced Thunderbird settings with a factory version and realized I had made some advanced changes, and I ended up finding the source of the problem.

Basically, if you remove the ā€˜User-Agent’ header from emails, the LT extension will start adding <script> tags, and after Thunderbird is restarted, the LT extension will also stop working.

How to remove the ā€˜User-Agent’ header:
• Go to the ā€˜Configuration Editor.’
• Set mailnews.headers.useMinimalUserAgent to false.
• Set general.useragent.override to an empty string.

Now, when you send an email, you’ll notice that the ā€˜User-Agent’ header, which contains the name of the email client, is no longer added to the email, but the LT extension will start adding <script> tags like this:

<script data-cookieconsent="ignore" src="moz-extension://27fd7dcd-e282-4eb8-a11c-7047bae7270f/content/executor.js" async="" fetchpriority="low"></script>

Additionally, after restarting Thunderbird, the LT extension will stop working.

I think that’s by design and hard to fix. The add-on is the same as used for Firefox, and it uses the User-Agent to see if it’s running in Firefox or Thunderbird. It will behave differently if it thinks it’s in Firefox.

I understand. Anyway, it’s good to have this on record. I was starting to question my sanity! At some point, someone else might encounter this as well, since using Thunderbird’s ā€˜User-Agent’ also triggers some spam filters (like SpamAssassin), or someone might remove it for personal reasons. So, it’s expected that more users will disable this header, and the extension will stop working as long as general.useragent.override exists, whether it’s empty (to remove the header) or contains something other than 'Mozilla/5.0 (OPERATING_SYSTEM; ARCHITECTURE; rv:RV_VERSION) Gecko/20100101 Thunderbird/CLIENT_VERSION' (to impersonate another email client).

Just to update what was mentioned earlier regarding the removal of the ā€œUser-Agentā€ header from sent emails, in case someone encounters this thread looking for a solution.

As of Thunderbird version 110 beta, a new preference was introduced: mailnews.headers.sendUserAgent. Simply set it to false (using the config editor), and the ā€œUser-Agentā€ header will no longer be included in your emails. This will not change Thunderbird’s default user agent, as the old method did, ensuring that extensions like LT or others relying on user agent checks function properly.