Title: Frederick Ding's Replies | WordPress.org

---

# Frederick Ding

  [  ](https://wordpress.org/support/users/frederickding/)

 *   [Profile](https://wordpress.org/support/users/frederickding/)
 *   [Topics Started](https://wordpress.org/support/users/frederickding/topics/)
 *   [Replies Created](https://wordpress.org/support/users/frederickding/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/frederickding/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/frederickding/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/frederickding/engagements/)
 *   [Favorites](https://wordpress.org/support/users/frederickding/favorites/)

 Search replies:

## Forum Replies Created

Viewing 3 replies - 1 through 3 (of 3 total)

 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Jetpack - WP Security, Backup, Speed, & Growth] Share article by mail is exploitable to send spam](https://wordpress.org/support/topic/share-article-by-mail-is-exploitable-to-send-spam/)
 *  [Frederick Ding](https://wordpress.org/support/users/frederickding/)
 * (@frederickding)
 * [6 years, 6 months ago](https://wordpress.org/support/topic/share-article-by-mail-is-exploitable-to-send-spam/#post-12432562)
 * I also have Akismet enabled. I took a look at the Jetpack source code and it’s
   pretty clear that the code isn’t set up to prevent this form of abuse.
 * Funnily enough, the Jetpack source code detects “blacklisted” characters in the
   name but decides to MIME-encode them (thus preserving them and allowing the characters
   to go through): [https://github.com/Automattic/jetpack/blob/241671d60d80fd78a1fb3753eb919eb542b5f520/modules/sharedaddy/sharedaddy.php#L25-L46](https://github.com/Automattic/jetpack/blob/241671d60d80fd78a1fb3753eb919eb542b5f520/modules/sharedaddy/sharedaddy.php#L25-L46)(
   [committed March 28, 2017](https://github.com/Automattic/jetpack/commit/8b585279ec9ad72abc3a55eb91de515de903f5f2))
 * However, it only MIME-encodes them in the name, and passes such spammy names 
   through in the body of an email _without_ sanitizing the junk: [https://github.com/Automattic/jetpack/blob/335ccaf7f2469ccafd313a879bcd48ab4ea9e6b0/modules/sharedaddy/sharedaddy.php#L103-L111](https://github.com/Automattic/jetpack/blob/335ccaf7f2469ccafd313a879bcd48ab4ea9e6b0/modules/sharedaddy/sharedaddy.php#L103-L111)
 * The name field is [part of what gets passed to Akismet](https://github.com/Automattic/jetpack/blob/335ccaf7f2469ccafd313a879bcd48ab4ea9e6b0/modules/sharedaddy/sharedaddy.php#L81),
   but it looks like Akismet isn’t smart enough yet to recognize this pattern of
   abuse.
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[Jetpack - WP Security, Backup, Speed, & Growth] Share article by mail is exploitable to send spam](https://wordpress.org/support/topic/share-article-by-mail-is-exploitable-to-send-spam/)
 *  [Frederick Ding](https://wordpress.org/support/users/frederickding/)
 * (@frederickding)
 * [6 years, 6 months ago](https://wordpress.org/support/topic/share-article-by-mail-is-exploitable-to-send-spam/#post-12429048)
 * Noticed the same in my SMTP log ([here’s an example](https://s3.amazonaws.com/cdn.frederickding.com/2020/02/20200213-011730672-chrome.png)).
 *     ```
       Discreet dating.
       Anonymous sex meetings. Candid erotic dating.
       https://[link removed]
   
        (monttriv@i.ua) thinks you may be interested in the following post:
       ```
   
    -  This reply was modified 6 years, 6 months ago by [Frederick Ding](https://wordpress.org/support/users/frederickding/).
      Reason: Removed identifying details in screenshot
 *   Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/)
    In
   reply to: [[OGraphr for WordPress] Alcohol flag always on](https://wordpress.org/support/topic/alcohol-flag-always-on/)
 *  Thread Starter [Frederick Ding](https://wordpress.org/support/users/frederickding/)
 * (@frederickding)
 * [13 years ago](https://wordpress.org/support/topic/alcohol-flag-always-on/#post-3960123)
 * It looks like user agent detection is hard-coded for Facebook-specific tags; 
   this **fails** spectacularly due to caching.

Viewing 3 replies - 1 through 3 (of 3 total)