From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp12.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms5.migadu.com with LMTPS id gFoFL9EuA2N/NQEAbAwnHQ (envelope-from ) for ; Mon, 22 Aug 2022 09:22:57 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp12.migadu.com with LMTPS id gOrtLtEuA2MyQwEAauVa8A (envelope-from ) for ; Mon, 22 Aug 2022 09:22:57 +0200 Received: from mail.notmuchmail.org (yantan.tethera.net [135.181.149.255]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 362989D4F for ; Mon, 22 Aug 2022 09:22:57 +0200 (CEST) Received: from yantan.tethera.net (localhost [127.0.0.1]) by mail.notmuchmail.org (Postfix) with ESMTP id 8D6105F371; Mon, 22 Aug 2022 07:22:54 +0000 (UTC) X-Greylist: delayed 1802 seconds by postgrey-1.36 at yantan; Mon, 22 Aug 2022 07:22:51 UTC Received: from smtpout2.mo529.mail-out.ovh.net (smtpout2.mo529.mail-out.ovh.net [79.137.123.220]) by mail.notmuchmail.org (Postfix) with ESMTPS id B9BCF5F36B for ; Mon, 22 Aug 2022 07:22:51 +0000 (UTC) Received: from mxplan6.mail.ovh.net (unknown [10.109.138.217]) by mo529.mail-out.ovh.net (Postfix) with ESMTPS id 3A2AE11FB8527 for ; Mon, 22 Aug 2022 08:47:20 +0200 (CEST) Received: from jwilk.net (37.59.142.99) by DAG4EX1.mxp6.local (172.16.2.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.9; Mon, 22 Aug 2022 08:47:19 +0200 X-OVh-ClientIp: 5.172.255.46 Date: Mon, 22 Aug 2022 08:47:17 +0200 From: Jakub Wilk To: Subject: nmweb HTML injection Message-ID: <20220822064717.qftn4tr7cs4r2ian@jwilk.net> MIME-Version: 1.0 Content-Disposition: inline X-Originating-IP: [37.59.142.99] X-ClientProxiedBy: DAG7EX2.mxp6.local (172.16.2.62) To DAG4EX1.mxp6.local (172.16.2.31) X-Ovh-Tracer-GUID: 5dc7ad42-d2e7-4c1d-a3d7-b67b2624d3bb X-Ovh-Tracer-Id: 2771965571173504791 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: 0 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedvfedrvdeiiedguddugecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemucehtddtnecunecujfgurhepfffhvffukfggtgguihesthdtredttddtvdenucfhrhhomheplfgrkhhusgcuhghilhhkuceojhifihhlkhesjhifihhlkhdrnhgvtheqnecuggftrfgrthhtvghrnhepffeiheeuhfelteehhffhheekteekfeejgeduhfeiueeigfekleeuledujefftefhnecuffhomhgrihhnpehnohhtmhhutghhmhgrihhlrdhorhhgnecukfhppedtrddtrddtrddtpdefjedrheelrddugedvrdelleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhhouggvpehsmhhtphhouhhtpdhhvghlohepmhigphhlrghniedrmhgrihhlrdhovhhhrdhnvghtpdhinhgvtheptddrtddrtddrtddpmhgrihhlfhhrohhmpehjfihilhhksehjfihilhhkrdhnvghtpdhnsggprhgtphhtthhopedupdhrtghpthhtohepnhhothhmuhgthhesnhhothhmuhgthhhmrghilhdrohhrghdpoffvtefjohhsthepmhhohedvle Message-ID-Hash: NHIE6LXCPQ5XZTGOTHSEGNARZCH4STTR X-Message-ID-Hash: NHIE6LXCPQ5XZTGOTHSEGNARZCH4STTR X-MailFrom: jwilk@jwilk.net X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-notmuch.notmuchmail.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.3 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Content-Type: text/plain; charset="us-ascii"; format="flowed" Content-Transfer-Encoding: 7bit X-Migadu-Flow: FLOW_IN X-Migadu-To: larch@yhetil.org X-Migadu-Country: DE ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1661152977; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-owner:list-unsubscribe:list-subscribe:list-post; bh=9nagI7oKG5z6mq8ETvqtt3scDgf5NHaM9v2d2Y2hUoc=; b=RCdl1zADExWZwGCO/mxhGAQ3Iw7C4Xu3KgYkXkUDo25qNehtnZkOM2vA+I63XhjK8eOSEw WgkrZgxmIh0M6AiWqUB+fkyZ4qOcLSX8mxbZKnhGzeD+AQIhGvQu0dVCS/F6ZBDKvA0q6M hED4MiENzcpgd7M+ujTXFxjXeyr9FbA6L51eysMGF+g6DcDEqYp6c1PnVfBJwZX7wGHAWD SWQsQ/c3/MKaMGDw6Y+fCpmb6CF49U2q6zswXN3xh20qbRimMWRAo930+Bn30PbZ+xmOb1 45WATvns4em2X0R9/x7yzN6Tm9ERN3jAGMb9Aq9LNIYKil/1kqQAiTXzxkHlMQ== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1661152977; a=rsa-sha256; cv=none; b=kd3xCiyHH8HiHpE9gdDUI6Kf3llBcfuVAmzE4/zYG6v1Ndfkc71spkt+rjNWK47jG51xma rvJg92vRbMvHXPGj6bQjIK668xk2h37LEn4JAhqrgs7E6vIbzOWSkx8KoZm9ESxg8tjBgC 955APaYylsetN6LjKAw1vEan07M1B8GofTwikOn7qoF5aeGIUzCtE6hpnQs7eAnfjG7bP1 LiM2WdddYEnyY/3hzBNpzr3jfD0jz7CmSnxH9zyJ8TsQDl1sv8b/65IdrasCL6PPUad8vR CaDUH1c10qr03TFrDwG31KNroerjO6G6ETYenL90GGL7RW0GS1dzd7BlI3A6tw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of notmuch-bounces@notmuchmail.org designates 135.181.149.255 as permitted sender) smtp.mailfrom=notmuch-bounces@notmuchmail.org X-Migadu-Spam-Score: -2.30 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of notmuch-bounces@notmuchmail.org designates 135.181.149.255 as permitted sender) smtp.mailfrom=notmuch-bounces@notmuchmail.org X-Migadu-Queue-Id: 362989D4F X-Spam-Score: -2.30 X-Migadu-Scanner: scn1.migadu.com X-TUID: rypP2cI0F4i5 See: https://nmbug.notmuchmail.org/nmweb/search/markup%20where%20appropriate and

from the mail subject was dumped without escaping into HTML. -- Jakub Wilk