From: Robert Pluim <rpluim@gmail.com>
To: Max Nikulin <manikulin@gmail.com>
Cc: larsi@gnus.org, Eli Zaretskii <eliz@gnu.org>,
55926@debbugs.gnu.org, ignaciocasso@hotmail.com
Subject: bug#55926: 29.0.50; message.el does not normalize In-Reply-To field from web links
Date: Tue, 14 Jun 2022 18:27:40 +0200 [thread overview]
Message-ID: <87zgifyzur.fsf@gmail.com> (raw)
In-Reply-To: <cc0fd66e-9438-e835-8033-641d6e0a9d46@gmail.com> (Max Nikulin's message of "Tue, 14 Jun 2022 23:11:45 +0700")
>>>>> On Tue, 14 Jun 2022 23:11:45 +0700, Max Nikulin <manikulin@gmail.com> said:
Max> Unsure if it is possible to do something really weird through a
Max> specially crafted mailto: link (by adding some special headers), but
Max> it looks like it is possible to add something that sender may not like
Max> to see in its message. So it is better to sanitize input link
Max> parameters that are used to generate headers.
Iʼm not aware of any code in Emacs that calls `eval' or similar on
parameters passed to `browse-url' or `message-mailto', but you never
know. Donʼt use Emacs to connect to your bank's website :-)
I think Lars' changes here are enough.
Robert
--
next prev parent reply other threads:[~2022-06-14 16:27 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-12 11:44 bug#55926: 29.0.50; message.el does not normalize In-Reply-To field from web links Ignacio Casso
2022-06-13 12:34 ` Lars Ingebrigtsen
2022-06-13 13:02 ` Ignacio Casso
2022-06-13 14:47 ` Lars Ingebrigtsen
2022-06-13 12:41 ` Robert Pluim
2022-06-13 13:17 ` Ignacio Casso
2022-06-13 16:14 ` Max Nikulin
2022-06-13 16:33 ` Eli Zaretskii
2022-06-14 16:11 ` Max Nikulin
2022-06-14 16:27 ` Robert Pluim [this message]
2022-06-15 16:14 ` Max Nikulin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87zgifyzur.fsf@gmail.com \
--to=rpluim@gmail.com \
--cc=55926@debbugs.gnu.org \
--cc=eliz@gnu.org \
--cc=ignaciocasso@hotmail.com \
--cc=larsi@gnus.org \
--cc=manikulin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).