From a90821ef579aabe32fa9adf862b383493800ae2c Mon Sep 17 00:00:00 2001 From: Tim Bielawa Date: Sun, 4 Mar 2012 20:12:12 +1900 Subject: [PATCH] Re: [PATCH] Fix mml-quoting in responses where pgp-signing is enabled --- 3c/77208ca6189ef8d191ddf8379756233f3d7f44 | 152 ++++++++++++++++++++++ 1 file changed, 152 insertions(+) create mode 100644 3c/77208ca6189ef8d191ddf8379756233f3d7f44 diff --git a/3c/77208ca6189ef8d191ddf8379756233f3d7f44 b/3c/77208ca6189ef8d191ddf8379756233f3d7f44 new file mode 100644 index 000000000..047fc1277 --- /dev/null +++ b/3c/77208ca6189ef8d191ddf8379756233f3d7f44 @@ -0,0 +1,152 @@ +Return-Path: +X-Original-To: notmuch@notmuchmail.org +Delivered-To: notmuch@notmuchmail.org +Received: from localhost (localhost [127.0.0.1]) + by olra.theworths.org (Postfix) with ESMTP id BF6EE431FAF + for ; Sat, 3 Mar 2012 17:12:27 -0800 (PST) +X-Virus-Scanned: Debian amavisd-new at olra.theworths.org +X-Spam-Flag: NO +X-Spam-Score: -4.99 +X-Spam-Level: +X-Spam-Status: No, score=-4.99 tagged_above=-999 required=5 + tests=[RCVD_IN_DNSWL_HI=-5, T_MIME_NO_TEXT=0.01] autolearn=disabled +Received: from olra.theworths.org ([127.0.0.1]) + by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) + with ESMTP id b1MhqliM2LFb for ; + Sat, 3 Mar 2012 17:12:26 -0800 (PST) +Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) + by olra.theworths.org (Postfix) with ESMTP id 8BE55431FAE + for ; Sat, 3 Mar 2012 17:12:26 -0800 (PST) +Received: from int-mx10.intmail.prod.int.phx2.redhat.com + (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) + by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q241CLMq011042 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); + Sat, 3 Mar 2012 20:12:22 -0500 +Received: from dehydrator.rdu.redhat.com (spatula.rdu.redhat.com + [10.11.95.223]) + by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP + id q241CLP7023182 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); + Sat, 3 Mar 2012 20:12:21 -0500 +Received: from dehydrator.spatula.rdu.redhat.com (localhost [127.0.0.1]) + by dehydrator.rdu.redhat.com (Postfix) with ESMTP id BC7E123347; + Sat, 3 Mar 2012 20:12:20 -0500 (EST) +Received: (from tbielawa@localhost) + by dehydrator.spatula.rdu.redhat.com (8.14.5/8.14.5/Submit) id + q241CKBk027928; Sat, 3 Mar 2012 20:12:20 -0500 +X-Authentication-Warning: dehydrator.spatula.rdu.redhat.com: tbielawa set + sender to tbielawa@redhat.com using -f +From: Tim Bielawa +To: Jani Nikula , notmuch@notmuchmail.org +Subject: Re: [PATCH] Fix mml-quoting in responses where pgp-signing is enabled +In-Reply-To: <87ty25fe9u.fsf@nikula.org> +References: <1330812262-28272-1-git-send-email-tbielawa@redhat.com> + <87ty25fe9u.fsf@nikula.org> +User-Agent: Notmuch/0.12~rc1 (http://notmuchmail.org) Emacs/23.3.1 + (x86_64-redhat-linux-gnu) +Date: Sat, 03 Mar 2012 20:12:12 -0500 +Message-ID: <87fwdptbir.fsf@dehydrator.spatula.rdu.redhat.com> +MIME-Version: 1.0 +Content-Type: multipart/signed; boundary="=-=-="; + micalg=pgp-sha1; protocol="application/pgp-signature" +X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 +X-BeenThere: notmuch@notmuchmail.org +X-Mailman-Version: 2.1.13 +Precedence: list +List-Id: "Use and development of the notmuch mail system." + +List-Unsubscribe: , + +List-Archive: +List-Post: +List-Help: +List-Subscribe: , + +X-List-Received-Date: Sun, 04 Mar 2012 01:12:27 -0000 + +--=-=-= +Content-Transfer-Encoding: quoted-printable + +On Sun, 04 Mar 2012 01:36:29 +0200, Jani Nikula wrote: +> On Sat, 3 Mar 2012 17:04:22 -0500, Tim Bielawa wro= +te: +> > The addition of mml-quote-region (notmuch-mua.el) in 2c6710e3 breaks +> > automatic signing in replies. When replies are mml-quoted and signing +> > is enabled by default the "<#part sign=3Dpgpmime>" string will appear on +> > line 1. This will be consumed during the application of the +> > mml-quote-region function and transform into the inert string +> > "<#!part sign=3Dpgpmime>". The result is that responses will no longer +> > be signed by default. +> >=20 +> > This fix moves the point forward one line before applying the quoting +> > function. +> >=20 +> > Consideration: Clients not signing mail by default. The first line of +> > their responses would be skipped when the quoting function is +> > applied. This string takes this general form: +> >=20 +> > On Sat, 03 Mar 2012 12:55:14 -0800, notmuch-request@notmuchmail.org= + wrote: +> >=20 +> > Because the string is generated by notmuch I don't believe this fix +> > introduces the possibility for malicious mml commands being omitted +> > from the quoting. +>=20 +> Hmm, would it work to mml quote the reply *before* extracting it from +> the temp buffer, like below? It would handle not mml quoting the user's +> signature too. Completely untested... +>=20 +> BR, +> Jani. +>=20 +>=20 +> diff --git a/emacs/notmuch-mua.el b/emacs/notmuch-mua.el +> index 4be7c13..13244eb 100644 +> --- a/emacs/notmuch-mua.el +> +++ b/emacs/notmuch-mua.el +> @@ -95,6 +95,9 @@ list." +> (goto-char (point-min)) +> (setq headers (mail-header-extract))))) +> (forward-line 1) +> + ;; Original message may contain (malicious) MML tags. We must +> + ;; properly quote them in the reply. +> + (mml-quote-region (point) (point-max)) +> (setq body (buffer-substring (point) (point-max)))) +> ;; If sender is non-nil, set the From: header to its value. +> (when sender +> @@ -116,12 +119,7 @@ list." +> (push-mark)) +> (set-buffer-modified-p nil) +>=20=20 +> - (message-goto-body) +> - ;; Original message may contain (malicious) MML tags. We must +> - ;; properly quote them in the reply. Note that using `point-max' +> - ;; instead of `mark' here is wrong. The buffer may include user's +> - ;; signature which should not be MML-quoted. +> - (mml-quote-region (point) (mark))) +> + (message-goto-body)) +>=20=20 +> (defun notmuch-mua-forward-message () +> (message-forward) + +Works great. Passes unit tests. Definitely a better approach than the +original patch. + +> Notmuch test suite complete. +> All 381 tests behaved as expected (2 expected failures). + ++1 from me (this message replied to and signed using the new patch) + +=2D-=20 +Tim Bielawa + +--=-=-= +Content-Type: application/pgp-signature + +-----BEGIN PGP SIGNATURE----- + +iEUEARECAAYFAk9SwWwACgkQrQXnXgMzrjeIUgCXe6PNcE8pXqOctSHHM05jKmNC +iACgwdPsXMHAFnwZiI91vwTIn7/2CQA= +=6TcP +-----END PGP SIGNATURE----- +--=-=-=-- -- 2.26.2