[Bug]: Cloudflare - Email Obfuscation

[Phil-Pearce]

What happened?

Hi,
Attached are the screenshots I had recently.

Our PasswordPusher is behind cloudflare proxied DNS.
I recieved a push that said "Email Protected"

https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/

(I have javascript enabled - but this hasnt helped / Nor can I disable this cloudflare feature)

🔬 How to reproduce

Cloudflare Infront of passwordpusher with Email Address Obfuscation enabled.

💻 Code sample

🌍 Which edition

oss.pwpush.com

🌍 Environment

• pwpush.com (Hosted)
• Docker Image – pwpush
• Docker Image – pwpush-public-gateway
• Docker Image – pwpush-worker
• Docker Image – Custom image
• Digital Ocean – App Platform
• Digital Ocean – Kubernetes Service
• Heroku
• Microsoft Azure – App Service
• Microsoft Azure – Container Instances (ACI)
• Microsoft Azure – Container Apps (ACA)
• Microsoft Azure – Kubernetes Service (AKS)
• Google Cloud – App Engine
• Google Cloud – Cloud Run
• Google Cloud – Kubernetes Engine
• AWS – Elastic Container Service (ECS)
• AWS – Kubernetes Service
• Source Code
• Other (please specify below)

Other Install location

No response

📦 App version

2.6.5

📸 Screenshots

No response

📈 Expected behavior

No response

📎 Additional context

[pglombardo]

Hi @Phil-Pearce - this is Cloudflare's Scrape Shield. It rewrites page content which likely Password Pusher has a problem with because we have a strict content security policy in place (determines what JS can run to prevent against XSS).

You can disable it in In Cloudflare → Scrape Shield → disable Email Address Obfuscation for this zone.

Let me know how you want to proceed. Do you prefer to disable it?

[Phil-Pearce]

Unfortunately this is handled by a different team, so I doubt I can disable the cloudflare feature

[pglombardo]

Hrm our options might be limited then. A few ideas - but these depend largely on how you use Password Pusher:

1. Use JSON to retrieve. Add .json to the end of a URL and you get a JSON response.
2. Change to use a CLI tool to create and retrieve another way?
3. Ask infra for a path-scoped exception. Configuration Rule (or legacy Page Rule) that disables email obfuscation only for secret-view paths, for example: /p/*

A potential template ask for the IT team:

Password Pusher can show user secrets in HTML at /p/:token.
This tool is explicitly for secure distribution of payloads.

Cloudflare Email Obfuscation replaces any *@* in that HTML with “Email Protected”, 
corrupting credentials (emails, API keys, etc.).

Please either:

1. Disable email obfuscation for URI path /p/*, or
2. Provide a grey-cloud hostname for secret links only.

Reference: https://developers.cloudflare.com/waf/tools/scrape-shield/email-address-obfuscation/