Summary

JIRA is not checking if an incoming email has an empty/missing MESSAGE-ID since this is an edge case that should never happen (by definition each email should have a MESSAGE-ID that is the unique identifier for that email).

However, we have seen this happening and this caused issues in case a user replies to his own email having Jira in CC. In this case indeed an email with an empty IN-REPLY-TO header is created and, in case this email has no issue key in the subject, instead of creating a new issue it will be added as a comment to whatever issue ever received a comment added from an email with no MESSAGE-ID

Environment

This issue happened in JIRA Service Desk Cloud, but the class handling this if from JIRA Core

Steps to Reproduce

1. Somehow send an email with no message-id to JIRA, see that this will create a new issue without any problem (no errors returned)
2. With a different user (e.g. USER B) send an email to some other user (USERS C and D)  and JIRA in CC (no issue key in the subject)
3. As one of the other users, e.g. USER D, reply to the email from previous step leaving Jira in CC (so, still no issue key in the subject)
4. Still as USER D, reply to your own email from previous step. This will generate an email still having Jira in CC and no issue key in the subject. Also, in some cases this email will have an empty IN-REPLY-TO header as the below one:

   From: USER B
   To: JIRA
   References: <the MESSAGE-ID of the first email of the thread is in here> 
   In-Reply-To: 
   Subject: RE: test 
   

    

Expected Results

1. The email with empty MESSAGE-ID should be discarded and an error returned by JIRA.
2. The email with empty IN-REPLY-TO either creates a new ticket, or adds a comment to the issue that matches the MESSAGE-ID in the REFERENCES header

Actual Results

1. The email with empty MESSAGE-ID creates a new issue and the empty MESSAGE-ID is stored in JIRA DB.
2. The email with empty IN-REPLY-TO adds a comment to the issue created from the email in previous step.

Workaround

None at the moment. However, again, this should never happen but as written in https://en.wikipedia.org/wiki/Message-ID:

Message-IDs are required to have a specific format which is a subset of an email address[2] and to be globally unique. That is, no two different messages must ever have the same Message-ID. A common technique used by many message systems is to use a time and date stamp along with the local host's domain name, e.g., 950124.162336@example.com.[3] On the other hand, if two messages have the same Message-ID, they are presumed to be the same one and one version is discarded. But, as Google MTAs (message transfer agents) mangle the ones of Outlook, several same messages may coexist with original and mangled ones and create problems in referencing each other for threading