From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by olra.theworths.org (Postfix) with ESMTP id BC4FA431FAF for ; Sat, 3 Mar 2012 15:54:57 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at olra.theworths.org X-Spam-Flag: NO X-Spam-Score: -5 X-Spam-Level: X-Spam-Status: No, score=-5 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_HI=-5] autolearn=disabled Received: from olra.theworths.org ([127.0.0.1]) by localhost (olra.theworths.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qS7xfar0+lgA for ; Sat, 3 Mar 2012 15:54:57 -0800 (PST) Received: from mx4-phx2.redhat.com (mx4-phx2.redhat.com [209.132.183.25]) by olra.theworths.org (Postfix) with ESMTP id ECE54431FAE for ; Sat, 3 Mar 2012 15:54:56 -0800 (PST) Received: from zmail10.collab.prod.int.phx2.redhat.com (zmail10.collab.prod.int.phx2.redhat.com [10.5.83.12]) by mx4-phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q23NstD0031277; Sat, 3 Mar 2012 18:54:55 -0500 To: notmuch@notmuchmail.org, jani@nikula.org From: Tim Bielawa Date: Sat, 03 Mar 2012 18:54:55 -0500 (EST) X-Mailer: TouchDown X-Mailer: Zimbra 7.1.2_GA_3268 (MobileSync - TouchDown(MSRPC)/7.1.00012/) MIME-Version: 1.0 Subject: Re: [PATCH] Fix mml-quoting in responses where pgp-signing is enabled Content-Type: multipart/mixed;boundary="__1330818891440TOUCHDOWN_BOUNDARY__" Message-ID: <817359227.7576598.1330818895565.JavaMail.root@zmail10.collab.prod.int.phx2.redhat.com> X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Mar 2012 23:54:57 -0000 --__1330818891440TOUCHDOWN_BOUNDARY__ Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Great point, I considered that too after I authored the original patch. It's a better approach I think. I'll try and give it a test run later tonight. -----Original Message----- From: Jani Nikula [jani@nikula.org] Received: Saturday, 03 Mar 2012, 6:36pm To: Tim Bielawa [tbielawa@redhat.com]; notmuch@notmuchmail.org Subject: Re: [PATCH] Fix mml-quoting in responses where pgp-signing is enabled On Sat, 3 Mar 2012 17:04:22 -0500, Tim Bielawa wrote: > The addition of mml-quote-region (notmuch-mua.el) in 2c6710e3 breaks > automatic signing in replies. When replies are mml-quoted and signing > is enabled by default the "<#part sign=pgpmime>" string will appear on > line 1. This will be consumed during the application of the > mml-quote-region function and transform into the inert string > "<#!part sign=pgpmime>". The result is that responses will no longer > be signed by default. > > This fix moves the point forward one line before applying the quoting > function. > > Consideration: Clients not signing mail by default. The first line of > their responses would be skipped when the quoting function is > applied. This string takes this general form: > > On Sat, 03 Mar 2012 12:55:14 -0800, notmuch-request@notmuchmail.org wrote: > > Because the string is generated by notmuch I don't believe this fix > introduces the possibility for malicious mml commands being omitted > from the quoting. Hmm, would it work to mml quote the reply *before* extracting it from the temp buffer, like below? It would handle not mml quoting the user's signature too. Completely untested... BR, Jani. diff --git a/emacs/notmuch-mua.el b/emacs/notmuch-mua.el index 4be7c13..13244eb 100644 --- a/emacs/notmuch-mua.el +++ b/emacs/notmuch-mua.el @@ -95,6 +95,9 @@ list." (goto-char (point-min)) (setq headers (mail-header-extract))))) (forward-line 1) + ;; Original message may contain (malicious) MML tags. We must + ;; properly quote them in the reply. + (mml-quote-region (point) (point-max)) (setq body (buffer-substring (point) (point-max)))) ;; If sender is non-nil, set the From: header to its value. (when sender @@ -116,12 +119,7 @@ list." (push-mark)) (set-buffer-modified-p nil) - (message-goto-body) - ;; Original message may contain (malicious) MML tags. We must - ;; properly quote them in the reply. Note that using `point-max' - ;; instead of `mark' here is wrong. The buffer may include user's - ;; signature which should not be MML-quoted. - (mml-quote-region (point) (mark))) + (message-goto-body)) (defun notmuch-mua-forward-message () (message-forward) --__1330818891440TOUCHDOWN_BOUNDARY__--