Skip to content

fix(client-windows): read reply sender address via Redemption to avoid Outlook security prompt - #668

Draft
nblair2 wants to merge 1 commit into
cmu-sei:masterfrom
nblair2:fix/outlook-reply-oom-guard-prompt
Draft

fix(client-windows): read reply sender address via Redemption to avoid Outlook security prompt#668
nblair2 wants to merge 1 commit into
cmu-sei:masterfrom
nblair2:fix/outlook-reply-oom-guard-prompt

Conversation

@nblair2

@nblair2 nblair2 commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Fixes #667.

Problem

The Windows Outlook reply handlers read the incoming message's sender address directly off the Outlook Interop MailItem (folderItem.SenderEmailAddress). That property is guarded by Outlook's Object Model Guard, so on hosts where Outlook cannot confirm an up-to-date, registered antivirus it raises the "A program is trying to access email address information stored in Outlook" prompt and blocks the automated timeline until a user clicks Allow.

Every other Outlook action already routes through Redemption's SafeMailItem, which bypasses the guard; only the reply path still used raw Interop for the sender read.

Change

Wrap the inbox item in a Redemption SafeMailItem and read SenderEmailAddress from it, in both reply handlers:

  • src/Ghosts.Client.Windows/Handlers/Outlookv2.cs (ReplyViaOutlook)
  • src/Ghosts.Client.Windows/Handlers/Outlook.cs (ReplyViaOutlook)

using Redemption; and SafeMailItem are already present in both files (used on the send path), so no new imports or references. The change is intended to be behavior-preserving: SafeMailItem.SenderEmailAddress returns the same underlying MAPI property value (SMTP for internet senders, EX/X500 for Exchange senders) as MailItem.SenderEmailAddress — it just doesn't trip the guard. Non-guarded properties (SentOn, Subject, Body, Reply(), UnRead) are left on the Interop object.

Testing

Not runtime-tested. This is a code-level change verified by inspection only — I don't have a Windows/Outlook environment to build and exercise the .NET Framework client. The reasoning is that reading the same property through SafeMailItem (already used for sending in both handlers) yields the same value without invoking the Object Model Guard.

A maintainer with a Windows + Outlook + Redemption setup should confirm that, on a host where the prompt currently appears, a reply cycle (non-zero reply-probability, mail in the inbox) completes without the "access email address information" dialog and the reply still sends and resolves recipients correctly.

@nblair2
nblair2 marked this pull request as draft July 6, 2026 23:13
…d Outlook security prompt

The Windows Outlook reply handlers read the incoming message's sender address
directly off the Outlook Interop MailItem (folderItem.SenderEmailAddress). That
property is guarded by Outlook's Object Model Guard, so on machines where Outlook
cannot confirm an up-to-date, registered antivirus it raises the "A program is
trying to access email address information stored in Outlook" prompt and blocks
the automated timeline until a user clicks Allow.

Every other Outlook action already goes through Redemption's SafeMailItem, which
bypasses the guard; only the reply path still used raw Interop for the sender
read. Wrap the inbox item in a SafeMailItem and read SenderEmailAddress from it.
This is behavior-preserving (same underlying MAPI property value) and applies to
both Outlook.cs and Outlookv2.cs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@nblair2
nblair2 force-pushed the fix/outlook-reply-oom-guard-prompt branch from 31a570e to a59594d Compare July 6, 2026 23:19
@nblair2

nblair2 commented Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

Will test With #670

@nblair2

nblair2 commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Windows Outlook reply handler triggers Object Model Guard security prompt (reads SenderEmailAddress via Interop instead of Redemption)

2 participants