DomainKey-Signature: a=rsa-sha1; c=nofws; d=SSpaeth.de; h=from:to:subject
	:in-reply-to:references:date:message-id:mime-version:
	content-type; q=dns; s=sspaeth.de; b=gWLjVNFlq3CBG/GayJKgZbTF31L
	YmfeUNCF2mRdzb01k5tCwhdHn6yNO6/w3jVytpzZT8ioseGRbHhCLv0cFZLknPGO
	s9J37tPT3b8WmklkzYqUGZev9lfmAaeJvl9uxNVQbs8juMeMW5J+NYZorr5MBq5U
	13dPvAs/b6SBp8Gw=
From: Sebastian Spaeth <Sebastian@SSpaeth.de>
To: Patrick Totzke <patricktotzke@googlemail.com>, notmuch@notmuchmail.org
Subject: Re: [PATCH 2/2] [python] fix unsafe utf-8 decodings
In-Reply-To: <1313530667-10648-1-git-send-email-patricktotzke@gmail.com>
References: <1313155408-17156-1-git-send-email-patricktotzke@gmail.com>
	<1313530667-10648-1-git-send-email-patricktotzke@gmail.com>
User-Agent: Notmuch/0.7-19-gee4579a (http://notmuchmail.org) Emacs/23.2.1
	(x86_64-pc-linux-gnu)
Date: Wed, 17 Aug 2011 14:48:58 +0200
Message-ID: <87wrecqk3p.fsf@SSpaeth.de>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Precedence: list

--=-=-=
Content-Transfer-Encoding: quoted-printable

On Tue, 16 Aug 2011 22:37:47 +0100, Patrick Totzke <patricktotzke@googlemai=
l.com> wrote:
> This prevents unsafe calls to decode for return
> value None in get_authors/get_subject

Thanks for the heads up, I just pushed a modified version of this. Some
comments on the code below.

Sebastian

> -        tag =3D Tags._get(self._tags).decode('utf-8')
> +        tag =3D Tags._get(self._tags)
> +        if tag:
> +            tag =3D tag.decode('UTF-8')

This was already safe as=20
  if not nmlib.notmuch_tags_valid(self._tags):
was making sure that something useful will be returned.

> -        return Thread._get_authors(self._thread).decode('UTF-8')
> +        authors =3D Thread._get_authors(self._thread)
> +        if authors:
> +            return authors.decode('UTF-8')
> +        return None

> -        return Thread._get_subject(self._thread).decode('UTF-8')
> +        subject =3D Thread._get_subject(self._thread)
> +        if subject:
> +            return subject.decode('UTF-8')
> +        return None

Modified this to say:

foo =3D get_foo()
if foo is None:
   return None
return foo.decode('UTF-8')

Otherwise you would fall into a trap when e.g. the subject is empty and
a '' is returned. Your code would have returned "None". My version will
return ''.

Thanks!

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk5LuLoACgkQVYX1jMgnoGIjrwCeJ9GkxYX2rYmboZLkkJntextG
2h0An2afzUU+q77USkgy6Cuw5xAZQLGr
=X7et
-----END PGP SIGNATURE-----
--=-=-=--