1 Return-Path: <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net>
\r
2 X-Original-To: notmuch@notmuchmail.org
\r
3 Delivered-To: notmuch@notmuchmail.org
\r
4 Received: from localhost (localhost [127.0.0.1])
\r
5 by arlo.cworth.org (Postfix) with ESMTP id B25756DE1B46
\r
6 for <notmuch@notmuchmail.org>; Sat, 2 Jan 2016 03:50:21 -0800 (PST)
\r
7 X-Virus-Scanned: Debian amavisd-new at cworth.org
\r
11 X-Spam-Status: No, score=0.274 tagged_above=-999 required=5 tests=[AWL=0.077,
\r
12 DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
\r
13 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001,
\r
14 TVD_FROM_1=0.999] autolearn=disabled
\r
15 Received: from arlo.cworth.org ([127.0.0.1])
\r
16 by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024)
\r
17 with ESMTP id Lejg3kOnrf34 for <notmuch@notmuchmail.org>;
\r
18 Sat, 2 Jan 2016 03:50:19 -0800 (PST)
\r
19 Received: from know-smtprelay-omc-11.server.virginmedia.net
\r
20 (know-smtprelay-omc-11.server.virginmedia.net [80.0.253.75])
\r
21 by arlo.cworth.org (Postfix) with ESMTP id 7F7596DE176C
\r
22 for <notmuch@notmuchmail.org>; Sat, 2 Jan 2016 03:50:18 -0800 (PST)
\r
23 Received: from dev.koan19.net ([82.1.197.255])
\r
24 by know-smtprelay-11-imp with bizsmtp
\r
25 id 0zqG1s00Q5X6CWA01zqGgg; Sat, 02 Jan 2016 11:50:16 +0000
\r
26 X-Originating-IP: [82.1.197.255]
\r
28 X-Authority: v=2.1 cv=JO3GyJ+b c=1 sm=1 tr=0 a=D+CNGfzuhY6ArhcYgadsyQ==:117
\r
29 a=D+CNGfzuhY6ArhcYgadsyQ==:17 a=jxr8AxaCAAAA:8 a=dmPqMsitAAAA:8
\r
30 a=hov-Noh0Y1sA:10 a=kj9zAlcOel0A:10 a=qCHOGeoEAAAA:8 a=QIhr-27iAAAA:8
\r
31 a=NEAV23lmAAAA:8 a=M1f5AqskhWhO7JSazuMA:9 a=CjuIK1q_8ugA:10 a=Kk53PCjjK_cA:10
\r
32 a=-atrXUsF2IQA:10 a=WRNerh0Hs7oA:10 a=FRQ_JnYhHjcA:10
\r
33 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
\r
34 d=l2015aftruuq.dns007.net; i=@l2015aftruuq.dns007.net; q=dns/txt; s=l201512;
\r
35 t=1451735416; h=To : Cc : Subject : References : MIME-Version : Content-Type
\r
36 : In-Reply-To : From : Message-ID : Date : X-Originating-IP : Subject : From
\r
37 : Date; bh=Mhd4ybZDXaGzRLyeW2zyTNk2sjDtLVQqn6VILrdeMrM=;
\r
38 b=lKuJt4GBlEDNsfuZNw4/PApgk3Kj2EaF3Z70Wg2vZ+yGKmoj/9MWGwLInMgD6jpqV1eGpb
\r
39 FVp9kh0usRTlgGKYl9wSQu04wIAmdGx6T4+sBY/pc4XutjSajw8DOXYMIVRVKigSyu4YAWiS
\r
40 1feRvWxtHgkJBjF4JrtT3SSdOYReesXnVOis9NN56flHyDCVvwRJTrc5kKFMIxZaq/+0Slxw ==
\r
41 To: notmuch@notmuchmail.org
\r
42 Cc: Tomi Ollila <tomi.ollila@iki.fi>
\r
43 Subject: Re: cli/insert: do not lose the SMTP envelope
\r
44 References: <1451647279.42.86b0a8ab@201601.l2015aftruuq.dns007.net>
\r
45 <m2a8oob4ql.fsf@guru.guru-group.fi>
\r
47 Content-Type: text/plain; charset=us-ascii
\r
48 Content-Disposition: inline
\r
49 In-Reply-To: <m2a8oob4ql.fsf@guru.guru-group.fi>
\r
50 User-Agent: Mutt/1.5.23.1 (2014-03-12)
\r
51 From: J Farkas <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net>
\r
52 Message-ID: <1451735416.13.504ebc4c@201601.l2015aftruuq.dns007.net>
\r
53 Date: Sat, 02 Jan 2016 11:50:16 +0000
\r
54 X-BeenThere: notmuch@notmuchmail.org
\r
55 X-Mailman-Version: 2.1.20
\r
57 List-Id: "Use and development of the notmuch mail system."
\r
58 <notmuch.notmuchmail.org>
\r
59 List-Unsubscribe: <https://notmuchmail.org/mailman/options/notmuch>,
\r
60 <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>
\r
61 List-Archive: <http://notmuchmail.org/pipermail/notmuch/>
\r
62 List-Post: <mailto:notmuch@notmuchmail.org>
\r
63 List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>
\r
64 List-Subscribe: <https://notmuchmail.org/mailman/listinfo/notmuch>,
\r
65 <mailto:notmuch-request@notmuchmail.org?subject=subscribe>
\r
66 X-List-Received-Date: Sat, 02 Jan 2016 11:50:22 -0000
\r
68 On 2016-01-02 at 13:28:02, Tomi Ollila wrote:
\r
69 > On Fri, Jan 01 2016, J Farkas <jf.hyqohaczlksw4tx6ae@l2015aftruuq.dns007.net> wrote:
\r
70 > > Make sure we store the envelope sender/recipient if provided by
\r
71 > > qmail-command(8) in $RPLINE and $DTLINE.
\r
74 > Probably good feature, but like
\r
75 > http://www.qmail.org/man/man8/qmail-command.html
\r
78 > qmail-local supplies several useful environment variables to
\r
79 > command. WARNING: These environment variables are not
\r
80 > quoted. They may contain special characters. They are
\r
81 > under the control of a possibly malicious remote user.
\r
83 > Should we check that the contents of RPLINE and DTLINE are well-formed
\r
84 > before writing these to the mail files ?
\r
86 Thank you for reviewing and being so careful!
\r
88 That warning is not applicable for the *LINE variables which are
\r
89 supposed to end up in the message without further munging (they even
\r
90 have the LF appended already).
\r
92 The extra carefulness is only relevant for anyone trying to *parse*
\r
93 those strings, like $EXT via unsafe languages, when EXT becomes the
\r
94 part following the dash after the username (considering
\r
95 bgates-(){:;};shutdown@example.org for example)
\r
97 It still should be what the envelope sender was, and what was considered
\r
100 I actually checked if there's any relevance for this warning: most
\r
101 maildir delivering program does it already in one form or the other; in
\r
102 fact, there is a command in the qmail distribution:
\r
103 http://www.qmail.org/man/man1/preline.html which does the exact same
\r
104 getenv and copy to the output.
\r
106 If you'd liek to confirm, there's one repo for what seems to be the
\r
107 original qmail source for this file shows even DJB does it the same way:
\r
109 https://github.com/c-rack/qmail/blob/master/preline.c
\r
111 I would think it's not worth the extra fork and pipe for this. I don't
\r
112 see how anyone could do without these headers saved, to be honest :)
\r
projects / notmuch-archives.git / blob