Re: Reproducers for recent Emacs security issues

[Andrew Cohen <acohen@ust.hk>]

>>>>> "IR" == Ihor Radchenko <yantar92@posteo.net> writes:

    IR> Max Nikulin <manikulin@gmail.com> writes:

[...]

    >> 
    >> I expect that message body should not affect attachment preview.

    IR> This sounds like gnus bug (or feature?).  I can also reproduce
    IR> it.  Feel free to submit it as a separate bug report.

The culprit here is gnus-article-emulate-mime (which defaults to t):

"If non-nil, use MIME emulation for uuencode and the like.

This means that Gnus will search message bodies for text that look
like uuencoded bits, yEncoded bits, and so on, and present that using
the normal Gnus MIME machinery."

Even though this sample message is mime, with this variable non-nil the
message bodies are searched as the doc describes. But the parsing fails
on this message, and ends up with some rather confused "parts": in
particular one which contains just the URL, but for some reason calls
org to dispaly itself.

Given that these alternative encodings are ancient and probably no
longer relevant, I suggest we change the default to nil.