1 Return-Path: <tomi.ollila@iki.fi>
\r
2 X-Original-To: notmuch@notmuchmail.org
\r
3 Delivered-To: notmuch@notmuchmail.org
\r
4 Received: from localhost (localhost [127.0.0.1])
\r
5 by olra.theworths.org (Postfix) with ESMTP id 0BC15431FC2
\r
6 for <notmuch@notmuchmail.org>; Sun, 20 Oct 2013 10:49:35 -0700 (PDT)
\r
7 X-Virus-Scanned: Debian amavisd-new at olra.theworths.org
\r
11 X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[none]
\r
13 Received: from olra.theworths.org ([127.0.0.1])
\r
14 by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024)
\r
15 with ESMTP id fvs0wwYE6ELi for <notmuch@notmuchmail.org>;
\r
16 Sun, 20 Oct 2013 10:49:27 -0700 (PDT)
\r
17 Received: from guru.guru-group.fi (guru.guru-group.fi [46.183.73.34])
\r
18 by olra.theworths.org (Postfix) with ESMTP id 95738431FC0
\r
19 for <notmuch@notmuchmail.org>; Sun, 20 Oct 2013 10:49:26 -0700 (PDT)
\r
20 Received: from guru.guru-group.fi (localhost [IPv6:::1])
\r
21 by guru.guru-group.fi (Postfix) with ESMTP id A7C2710007D;
\r
22 Sun, 20 Oct 2013 20:49:20 +0300 (EEST)
\r
23 From: Tomi Ollila <tomi.ollila@iki.fi>
\r
24 To: Austin Clements <amdragon@MIT.EDU>, notmuch@notmuchmail.org
\r
25 Subject: Re: [PATCH WIP] emacs: Sanitize authors and subjects in search and
\r
27 In-Reply-To: <1381499619-14219-1-git-send-email-amdragon@mit.edu>
\r
28 References: <1381499619-14219-1-git-send-email-amdragon@mit.edu>
\r
29 User-Agent: Notmuch/0.16+112~g46b74be (http://notmuchmail.org) Emacs/24.3.1
\r
30 (x86_64-unknown-linux-gnu)
\r
31 X-Face: HhBM'cA~<r"^Xv\KRN0P{vn'Y"Kd;zg_y3S[4)KSN~s?O\"QPoL
\r
32 $[Xv_BD:i/F$WiEWax}R(MPS`^UaptOGD`*/=@\1lKoVa9tnrg0TW?"r7aRtgk[F
\r
33 !)g;OY^,BjTbr)Np:%c_o'jj,Z
\r
34 Date: Sun, 20 Oct 2013 20:49:20 +0300
\r
35 Message-ID: <m2ppqzq1cv.fsf@guru.guru-group.fi>
\r
37 Content-Type: text/plain
\r
38 X-BeenThere: notmuch@notmuchmail.org
\r
39 X-Mailman-Version: 2.1.13
\r
41 List-Id: "Use and development of the notmuch mail system."
\r
42 <notmuch.notmuchmail.org>
\r
43 List-Unsubscribe: <http://notmuchmail.org/mailman/options/notmuch>,
\r
44 <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>
\r
45 List-Archive: <http://notmuchmail.org/pipermail/notmuch>
\r
46 List-Post: <mailto:notmuch@notmuchmail.org>
\r
47 List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>
\r
48 List-Subscribe: <http://notmuchmail.org/mailman/listinfo/notmuch>,
\r
49 <mailto:notmuch-request@notmuchmail.org?subject=subscribe>
\r
50 X-List-Received-Date: Sun, 20 Oct 2013 17:49:35 -0000
\r
52 On Fri, Oct 11 2013, Austin Clements <amdragon@MIT.EDU> wrote:
\r
54 > Authors and subjects can contain embedded, encoded control characters
\r
55 > like "\n" and "\t" that mess up display. Transform control characters
\r
56 > into spaces everywhere we display them in search and show.
\r
65 > This could obviously use some tests, but I thought I'd get it out
\r
66 > there to see what people thought or if the behavior should be tweaked.
\r
68 > Of course, I can't guarantee that this is all of the places we display
\r
69 > untrusted header text. I'm really not sure how to make that guarantee
\r
70 > (suggestions welcome).
\r
72 > emacs/notmuch-lib.el | 6 ++++++
\r
73 > emacs/notmuch-show.el | 7 ++++---
\r
74 > emacs/notmuch.el | 6 ++++--
\r
75 > 3 files changed, 14 insertions(+), 5 deletions(-)
\r
77 > diff --git a/emacs/notmuch-lib.el b/emacs/notmuch-lib.el
\r
78 > index 58f3313..6541282 100644
\r
79 > --- a/emacs/notmuch-lib.el
\r
80 > +++ b/emacs/notmuch-lib.el
\r
81 > @@ -243,6 +243,12 @@ depending on the value of `notmuch-poll-script'."
\r
85 > +(defun notmuch-sanitize (str)
\r
86 > + "Sanitize control character in STR.
\r
88 > +This includes newlines, tabs, and other funny characters."
\r
89 > + (replace-regexp-in-string "[[:cntrl:]\x7f\u2028\u2029]+" " " str))
\r
91 > (defun notmuch-escape-boolean-term (term)
\r
92 > "Escape a boolean term for use in a query.
\r
94 > diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
\r
95 > index 7325792..fa11d98 100644
\r
96 > --- a/emacs/notmuch-show.el
\r
97 > +++ b/emacs/notmuch-show.el
\r
98 > @@ -407,7 +407,8 @@ unchanged ADDRESS if parsing fails."
\r
99 > message at DEPTH in the current thread."
\r
100 > (let ((start (point)))
\r
101 > (insert (notmuch-show-spaces-n (* notmuch-show-indent-messages-width depth))
\r
102 > - (notmuch-show-clean-address (plist-get headers :From))
\r
103 > + (notmuch-sanitize
\r
104 > + (notmuch-show-clean-address (plist-get headers :From)))
\r
108 > @@ -417,7 +418,7 @@ message at DEPTH in the current thread."
\r
110 > (defun notmuch-show-insert-header (header header-value)
\r
111 > "Insert a single header."
\r
112 > - (insert header ": " header-value "\n"))
\r
113 > + (insert header ": " (notmuch-sanitize header-value) "\n"))
\r
115 > (defun notmuch-show-insert-headers (headers)
\r
116 > "Insert the headers of the current message."
\r
117 > @@ -1154,7 +1155,7 @@ function is used."
\r
118 > (jit-lock-register #'notmuch-show-buttonise-links)
\r
120 > ;; Set the header line to the subject of the first message.
\r
121 > - (setq header-line-format (notmuch-show-strip-re (notmuch-show-get-subject)))
\r
122 > + (setq header-line-format (notmuch-sanitize (notmuch-show-strip-re (notmuch-show-get-subject))))
\r
124 > (run-hooks 'notmuch-show-hook))))
\r
126 > diff --git a/emacs/notmuch.el b/emacs/notmuch.el
\r
127 > index c47c6b5..44cd2fd 100644
\r
128 > --- a/emacs/notmuch.el
\r
129 > +++ b/emacs/notmuch.el
\r
130 > @@ -791,11 +791,13 @@ non-authors is found, assume that all of the authors match."
\r
131 > (plist-get result :total)))
\r
132 > 'face 'notmuch-search-count)))
\r
133 > ((string-equal field "subject")
\r
134 > - (insert (propertize (format format-string (plist-get result :subject))
\r
135 > + (insert (propertize (format format-string
\r
136 > + (notmuch-sanitize (plist-get result :subject)))
\r
137 > 'face 'notmuch-search-subject)))
\r
139 > ((string-equal field "authors")
\r
140 > - (notmuch-search-insert-authors format-string (plist-get result :authors)))
\r
141 > + (notmuch-search-insert-authors
\r
142 > + format-string (notmuch-sanitize (plist-get result :authors))))
\r
144 > ((string-equal field "tags")
\r
145 > (let ((tags (plist-get result :tags)))
\r
149 > _______________________________________________
\r
150 > notmuch mailing list
\r
151 > notmuch@notmuchmail.org
\r
152 > http://notmuchmail.org/mailman/listinfo/notmuch
\r