Re: cli/insert: do not lose the SMTP envelope

diff --git a/d1/08f77b9fa49afb867b1d0a2f799eaa4e3225d4 b/d1/08f77b9fa49afb867b1d0a2f799eaa4e3225d4
new file mode 100644 (file)
index 0000000..3fd3bda
--- /dev/null
+++ b/d1/08f77b9fa49afb867b1d0a2f799eaa4e3225d4
@@ -0,0 +1,115 @@
+Return-Path: <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net>\r
+X-Original-To: notmuch@notmuchmail.org\r
+Delivered-To: notmuch@notmuchmail.org\r
+Received: from localhost (localhost [127.0.0.1])\r
+ by arlo.cworth.org (Postfix) with ESMTP id B25756DE1B46\r
+ for <notmuch@notmuchmail.org>; Sat,  2 Jan 2016 03:50:21 -0800 (PST)\r
+X-Virus-Scanned: Debian amavisd-new at cworth.org\r
+X-Spam-Flag: NO\r
+X-Spam-Score: 0.274\r
+X-Spam-Level: \r
+X-Spam-Status: No, score=0.274 tagged_above=-999 required=5 tests=[AWL=0.077, \r
+ DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,\r
+ RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001,\r
+ TVD_FROM_1=0.999] autolearn=disabled\r
+Received: from arlo.cworth.org ([127.0.0.1])\r
+ by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024)\r
+ with ESMTP id Lejg3kOnrf34 for <notmuch@notmuchmail.org>;\r
+ Sat,  2 Jan 2016 03:50:19 -0800 (PST)\r
+Received: from know-smtprelay-omc-11.server.virginmedia.net\r
+ (know-smtprelay-omc-11.server.virginmedia.net [80.0.253.75])\r
+ by arlo.cworth.org (Postfix) with ESMTP id 7F7596DE176C\r
+ for <notmuch@notmuchmail.org>; Sat,  2 Jan 2016 03:50:18 -0800 (PST)\r
+Received: from dev.koan19.net ([82.1.197.255])\r
+ by know-smtprelay-11-imp with bizsmtp\r
+ id 0zqG1s00Q5X6CWA01zqGgg; Sat, 02 Jan 2016 11:50:16 +0000\r
+X-Originating-IP: [82.1.197.255]\r
+X-Spam: 0\r
+X-Authority: v=2.1 cv=JO3GyJ+b c=1 sm=1 tr=0 a=D+CNGfzuhY6ArhcYgadsyQ==:117\r
+ a=D+CNGfzuhY6ArhcYgadsyQ==:17 a=jxr8AxaCAAAA:8 a=dmPqMsitAAAA:8\r
+ a=hov-Noh0Y1sA:10 a=kj9zAlcOel0A:10 a=qCHOGeoEAAAA:8 a=QIhr-27iAAAA:8\r
+ a=NEAV23lmAAAA:8 a=M1f5AqskhWhO7JSazuMA:9 a=CjuIK1q_8ugA:10 a=Kk53PCjjK_cA:10\r
+ a=-atrXUsF2IQA:10 a=WRNerh0Hs7oA:10 a=FRQ_JnYhHjcA:10\r
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;\r
+ d=l2015aftruuq.dns007.net; i=@l2015aftruuq.dns007.net; q=dns/txt; s=l201512;\r
+ t=1451735416; h=To :  Cc : Subject : References : MIME-Version : Content-Type\r
+ : In-Reply-To :  From : Message-ID : Date : X-Originating-IP : Subject : From\r
+ : Date;  bh=Mhd4ybZDXaGzRLyeW2zyTNk2sjDtLVQqn6VILrdeMrM=;\r
+  b=lKuJt4GBlEDNsfuZNw4/PApgk3Kj2EaF3Z70Wg2vZ+yGKmoj/9MWGwLInMgD6jpqV1eGpb\r
+ FVp9kh0usRTlgGKYl9wSQu04wIAmdGx6T4+sBY/pc4XutjSajw8DOXYMIVRVKigSyu4YAWiS\r
+ 1feRvWxtHgkJBjF4JrtT3SSdOYReesXnVOis9NN56flHyDCVvwRJTrc5kKFMIxZaq/+0Slxw ==\r
+To: notmuch@notmuchmail.org\r
+Cc: Tomi Ollila <tomi.ollila@iki.fi>\r
+Subject: Re: cli/insert: do not lose the SMTP envelope\r
+References: <1451647279.42.86b0a8ab@201601.l2015aftruuq.dns007.net>\r
+ <m2a8oob4ql.fsf@guru.guru-group.fi>\r
+MIME-Version: 1.0\r
+Content-Type: text/plain; charset=us-ascii\r
+Content-Disposition: inline\r
+In-Reply-To: <m2a8oob4ql.fsf@guru.guru-group.fi>\r
+User-Agent: Mutt/1.5.23.1 (2014-03-12)\r
+From: J Farkas <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net>\r
+Message-ID: <1451735416.13.504ebc4c@201601.l2015aftruuq.dns007.net>\r
+Date: Sat, 02 Jan 2016 11:50:16 +0000\r
+X-BeenThere: notmuch@notmuchmail.org\r
+X-Mailman-Version: 2.1.20\r
+Precedence: list\r
+List-Id: "Use and development of the notmuch mail system."\r
+ <notmuch.notmuchmail.org>\r
+List-Unsubscribe: <https://notmuchmail.org/mailman/options/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>\r
+List-Archive: <http://notmuchmail.org/pipermail/notmuch/>\r
+List-Post: <mailto:notmuch@notmuchmail.org>\r
+List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>\r
+List-Subscribe: <https://notmuchmail.org/mailman/listinfo/notmuch>,\r
+ <mailto:notmuch-request@notmuchmail.org?subject=subscribe>\r
+X-List-Received-Date: Sat, 02 Jan 2016 11:50:22 -0000\r
+\r
+On 2016-01-02 at 13:28:02, Tomi Ollila wrote:\r
+> On Fri, Jan 01 2016, J Farkas <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net> wrote:\r
+> > Make sure we store the envelope sender/recipient if provided by\r
+> > qmail-command(8) in $RPLINE and $DTLINE.\r
+> > ---\r
+> \r
+> Probably good feature, but like\r
+> http://www.qmail.org/man/man8/qmail-command.html \r
+> says:\r
+> \r
+>           qmail-local supplies several useful environment variables to\r
+>           command.  WARNING: These environment variables are not\r
+>           quoted.  They may contain special characters.  They are\r
+>           under the control of a possibly malicious remote user.\r
+> \r
+> Should we check that the contents of RPLINE and DTLINE are well-formed\r
+> before writing these to the mail files ?\r
+\r
+Thank you for reviewing and being so careful!\r
+\r
+That warning is not applicable for the *LINE variables which are\r
+supposed to end up in the message without further munging (they even\r
+have the LF appended already).\r
+\r
+The extra carefulness is only relevant for anyone trying to *parse*\r
+those strings, like $EXT via unsafe languages, when EXT becomes the\r
+part following the dash after the username (considering \r
+bgates-(){:;};shutdown@example.org for example)\r
+\r
+It still should be what the envelope sender was, and what was considered\r
+valid at the time.\r
+\r
+I actually checked if there's any relevance for this warning: most\r
+maildir delivering program does it already in one form or the other; in\r
+fact, there is a command in the qmail distribution:\r
+http://www.qmail.org/man/man1/preline.html which does the exact same\r
+getenv and copy to the output.\r
+\r
+If you'd liek to confirm, there's one repo for what seems to be the\r
+original qmail source for this file shows even DJB does it the same way:\r
+\r
+https://github.com/c-rack/qmail/blob/master/preline.c\r
+\r
+I would think it's not worth the extra fork and pipe for this.  I don't\r
+see how anyone could do without these headers saved, to be honest :)\r
+\r
+Janos\r
+\r