From b08f7825825a9ae8cf769f1fadd619892e8aad8c Mon Sep 17 00:00:00 2001 From: Jinwoo Lee Date: Tue, 3 Feb 2015 13:04:52 +1600 Subject: [PATCH] [PATCH] emacs: Add a defcustom that specifies regexp for blocked remote images. --- 58/5eddcb9df06e071b17bc2fcda308f430f8386d | 131 ++++++++++++++++++++++ 1 file changed, 131 insertions(+) create mode 100644 58/5eddcb9df06e071b17bc2fcda308f430f8386d diff --git a/58/5eddcb9df06e071b17bc2fcda308f430f8386d b/58/5eddcb9df06e071b17bc2fcda308f430f8386d new file mode 100644 index 000000000..c27ecb0fb --- /dev/null +++ b/58/5eddcb9df06e071b17bc2fcda308f430f8386d @@ -0,0 +1,131 @@ +Return-Path: +X-Original-To: notmuch@notmuchmail.org +Delivered-To: notmuch@notmuchmail.org +Received: from localhost (localhost [127.0.0.1]) + by olra.theworths.org (Postfix) with ESMTP id 1B43E431FC2 + for ; Mon, 2 Feb 2015 13:05:18 -0800 (PST) +X-Virus-Scanned: Debian amavisd-new at olra.theworths.org +X-Spam-Flag: NO +X-Spam-Score: 2.639 +X-Spam-Level: ** +X-Spam-Status: No, score=2.639 tagged_above=-999 required=5 + tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, + DNS_FROM_AHBL_RHSBL=2.438, FREEMAIL_ENVFROM_END_DIGIT=1, + FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=disabled +Received: from olra.theworths.org ([127.0.0.1]) + by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) + with ESMTP id I46a4eHPQLi9 for ; + Mon, 2 Feb 2015 13:05:14 -0800 (PST) +Received: from mail-ie0-f182.google.com (mail-ie0-f182.google.com + [209.85.223.182]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) + (No client certificate requested) + by olra.theworths.org (Postfix) with ESMTPS id D7985431FC0 + for ; Mon, 2 Feb 2015 13:05:14 -0800 (PST) +Received: by mail-ie0-f182.google.com with SMTP id ar1so20455552iec.13 + for ; Mon, 02 Feb 2015 13:05:14 -0800 (PST) +DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; + h=from:to:cc:subject:date:message-id:in-reply-to:references; + bh=H9rXb5RRmjey2cmR1oOH1SyStU1lN+VP7SE349D2ODc=; + b=S116eKIm8we2lwEW5pl7jWvcOR2ppYYnvYL9Zo0N/OrgpbKDbWpyYNpjclw5qOBC3V + aKP2XwxPsYXym5bOx3OXdYGb+ti4OHZtFHP+XQbM9U2/WEVIYwAopaID3P1kVkel7mC2 + Q2SoQM5mQ3Phw5wf4fqHejhLWdkJYKUIYbyU0WQNM/9G8I5Hrx+gInBVL9wuHi+3JI8v + xDIzruVAnwhR2eN1Nw5wpK/TI73GK9NUbnkqGHMEm++k36rF9qQRKiENbyYklSit+sgQ + TImh34Xf5o928il/L/atBNn5N2dFmS+1nhLWGo/AxdQHElz8dnfVVLEhXSbwUxK8vm2y + h5yg== +X-Received: by 10.50.234.194 with SMTP id ug2mr14140022igc.39.1422911114338; + Mon, 02 Feb 2015 13:05:14 -0800 (PST) +Received: from jinwoo-macbookair.roam.corp.google.com.com ([172.19.60.210]) + by mx.google.com with ESMTPSA id + ie15sm6734034igb.12.2015.02.02.13.05.13 + (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); + Mon, 02 Feb 2015 13:05:13 -0800 (PST) +From: Jinwoo Lee +To: notmuch@notmuchmail.org +Subject: [PATCH] emacs: Add a defcustom that specifies regexp for blocked + remote images. +Date: Mon, 2 Feb 2015 13:04:52 -0800 +Message-Id: <1422911092-18231-1-git-send-email-jinwoo68@gmail.com> +X-Mailer: git-send-email 2.2.2 +In-Reply-To: +References: +X-BeenThere: notmuch@notmuchmail.org +X-Mailman-Version: 2.1.13 +Precedence: list +List-Id: "Use and development of the notmuch mail system." + +List-Unsubscribe: , + +List-Archive: +List-Post: +List-Help: +List-Subscribe: , + +X-List-Received-Date: Mon, 02 Feb 2015 21:05:18 -0000 + +It's default value is ".", meaning all remote images will be blocked +by default. + +--- +Addressed review comments. +--- + emacs/notmuch-show.el | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el +index 66350d4..f4ad802 100644 +--- a/emacs/notmuch-show.el ++++ b/emacs/notmuch-show.el +@@ -136,6 +136,13 @@ indentation." + :type 'boolean + :group 'notmuch-show) + ++;; By default, block all external images to prevent privacy leaks and ++;; potential attacks. ++(defcustom notmuch-show-text/html-blocked-images "." ++ "Remote images that have URLs matching this regexp will be blocked." ++ :type '(choice (const nil) regexp) ++ :group 'notmuch-show) ++ + (defvar notmuch-show-thread-id nil) + (make-variable-buffer-local 'notmuch-show-thread-id) + (put 'notmuch-show-thread-id 'permanent-local t) +@@ -771,14 +778,21 @@ will return nil if the CID is unknown or cannot be retrieved." + ;; It's easier to drive shr ourselves than to work around the + ;; goofy things `mm-shr' does (like irreversibly taking over + ;; content ID handling). +- (notmuch-show--insert-part-text/html-shr msg part) ++ ++ ;; FIXME: If we block an image, offer a button to load external ++ ;; images. ++ (let ((shr-blocked-images notmuch-show-text/html-blocked-images)) ++ (notmuch-show--insert-part-text/html-shr msg part)) + ;; Otherwise, let message-mode do the heavy lifting + ;; + ;; w3m sets up a keymap which "leaks" outside the invisible region + ;; and causes strange effects in notmuch. We set + ;; mm-inline-text-html-with-w3m-keymap to nil to tell w3m not to + ;; set a keymap (so the normal notmuch-show-mode-map remains). +- (let ((mm-inline-text-html-with-w3m-keymap nil)) ++ (let ((mm-inline-text-html-with-w3m-keymap nil) ++ ;; FIXME: If we block an image, offer a button to load external ++ ;; images. ++ (gnus-blocked-images notmuch-show-text/html-blocked-images)) + (notmuch-show-insert-part-*/* msg part content-type nth depth button)))) + + ;; These functions are used by notmuch-show--insert-part-text/html-shr +@@ -797,11 +811,7 @@ will return nil if the CID is unknown or cannot be retrieved." + ;; shr strips the "cid:" part of URL, but doesn't + ;; URL-decode it (see RFC 2392). + (let ((cid (url-unhex-string url))) +- (first (notmuch-show--get-cid-content cid))))) +- ;; Block all external images to prevent privacy leaks and +- ;; potential attacks. FIXME: If we block an image, offer a +- ;; button to load external images. +- (shr-blocked-images ".")) ++ (first (notmuch-show--get-cid-content cid)))))) + (shr-insert-document dom) + t)) + +-- +2.2.2 + -- 2.26.2