[PATCH] Add a defcustom for whether to block remote images by default.

[PATCH] Add a defcustom for whether to block remote images by default.

[Jinwoo Lee]

---
 emacs/notmuch-show.el | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
index 66350d4..bc48922 100644
--- a/emacs/notmuch-show.el
+++ b/emacs/notmuch-show.el
@@ -136,6 +136,11 @@ indentation."
   :type 'boolean
   :group 'notmuch-show)
 
+(defcustom notmuch-show-block-remote-images t
+  "Block remote images by default."
+  :type 'boolean
+  :group 'notmuch-show)
+
 (defvar notmuch-show-thread-id nil)
 (make-variable-buffer-local 'notmuch-show-thread-id)
 (put 'notmuch-show-thread-id 'permanent-local t)
@@ -798,10 +803,12 @@ will return nil if the CID is unknown or cannot be retrieved."
 	   ;; URL-decode it (see RFC 2392).
 	   (let ((cid (url-unhex-string url)))
 	     (first (notmuch-show--get-cid-content cid)))))
-	;; Block all external images to prevent privacy leaks and
-	;; potential attacks.  FIXME: If we block an image, offer a
-	;; button to load external images.
-	(shr-blocked-images "."))
+	;; By default, block all external images to prevent privacy
+	;; leaks and potential attacks.  FIXME: If we block an image,
+	;; offer a button to load external images.
+	(shr-blocked-images (if notmuch-show-block-remote-images
+				"."
+			      shr-blocked-images)))
     (shr-insert-document dom)
     t))
 
-- 
2.2.2

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[David Edmondson]

A defcustom for `notmuch-show-text/html-blocked-images', which is used
to set `shr-blocked-images', would be more usable. It can default to "."
to achieve the same result.

On Thu, Jan 29 2015, Jinwoo Lee wrote:
> ---
>  emacs/notmuch-show.el | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
> index 66350d4..bc48922 100644
> --- a/emacs/notmuch-show.el
> +++ b/emacs/notmuch-show.el
> @@ -136,6 +136,11 @@ indentation."
>    :type 'boolean
>    :group 'notmuch-show)
>  
> +(defcustom notmuch-show-block-remote-images t
> +  "Block remote images by default."
> +  :type 'boolean
> +  :group 'notmuch-show)
> +
>  (defvar notmuch-show-thread-id nil)
>  (make-variable-buffer-local 'notmuch-show-thread-id)
>  (put 'notmuch-show-thread-id 'permanent-local t)
> @@ -798,10 +803,12 @@ will return nil if the CID is unknown or cannot be retrieved."
>  	   ;; URL-decode it (see RFC 2392).
>  	   (let ((cid (url-unhex-string url)))
>  	     (first (notmuch-show--get-cid-content cid)))))
> -	;; Block all external images to prevent privacy leaks and
> -	;; potential attacks.  FIXME: If we block an image, offer a
> -	;; button to load external images.
> -	(shr-blocked-images "."))
> +	;; By default, block all external images to prevent privacy
> +	;; leaks and potential attacks.  FIXME: If we block an image,
> +	;; offer a button to load external images.
> +	(shr-blocked-images (if notmuch-show-block-remote-images
> +				"."
> +			      shr-blocked-images)))
>      (shr-insert-document dom)
>      t))
>  
> -- 
> 2.2.2
>
> _______________________________________________
> notmuch mailing list
> notmuch@notmuchmail.org
> http://notmuchmail.org/mailman/listinfo/notmuch

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[David Bremner]

Jinwoo Lee <jinwoo68@gmail.com> writes:

> +	(shr-blocked-images (if notmuch-show-block-remote-images
> +				"."
> +			      shr-blocked-images)))
>      (shr-insert-document dom)
>      t))

Ideally such a customization would apply to all html renders. I think
Tomi did some experiments with w3m and friends, I _think_ they respect
gnus-blocked-images, but maybe Tomi can comment.

d

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Tomi Ollila]

On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:

> Jinwoo Lee <jinwoo68@gmail.com> writes:
>
>> +	(shr-blocked-images (if notmuch-show-block-remote-images
>> +				"."
>> +			      shr-blocked-images)))
>>      (shr-insert-document dom)
>>      t))
>
> Ideally such a customization would apply to all html renders. I think
> Tomi did some experiments with w3m and friends, I _think_ they respect
> gnus-blocked-images, but maybe Tomi can comment.

I did M-x debug-on-entry RET open-network-stream RET  (or an equivalent of
t that in elisp, but the code I did is now lost & forgotten ;/

The docstring relevant to the renderers below it at the end of this email.

'gnus-w3m respect gnus-blocked-images

I could not run 'w3m on that system... nor 'w3

There was no effect with 'w3m-standalone -- in this case I'd think it is up
to w3m binary to load external stuff or not. I presume the same is the
case with 'links, 'lynx, 'html2text and nil

So, to add to David's suggestion maybe just set both gnus-blocked-images
and shr-blocked-images to the value of notmuch-show-text/html-blocked-images


Tomi


mm-text-html-renderer is a variable defined in `mm-decode.el'.
Its value is shr

Documentation:
Render of HTML contents.
It is one of defined renderer types, or a rendering function.
The defined renderer types are:
`shr': use the built-in Gnus HTML renderer;
`gnus-w3m': use Gnus renderer based on w3m;
`w3m': use emacs-w3m;
`w3m-standalone': use plain w3m;
`links': use links;
`lynx': use lynx;
`w3': use Emacs/W3;
`html2text': use html2text;
nil    : use external viewer (default web browser).


> d

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Jinwoo Lee]

On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>
>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>
>>> +	(shr-blocked-images (if notmuch-show-block-remote-images
>>> +				"."
>>> +			      shr-blocked-images)))
>>>      (shr-insert-document dom)
>>>      t))
>>
>> Ideally such a customization would apply to all html renders. I think
>> Tomi did some experiments with w3m and friends, I _think_ they respect
>> gnus-blocked-images, but maybe Tomi can comment.
>
> I did M-x debug-on-entry RET open-network-stream RET  (or an equivalent of
> t that in elisp, but the code I did is now lost & forgotten ;/
>
> The docstring relevant to the renderers below it at the end of this email.
>
> 'gnus-w3m respect gnus-blocked-images
>
> I could not run 'w3m on that system... nor 'w3
>
> There was no effect with 'w3m-standalone -- in this case I'd think it is up
> to w3m binary to load external stuff or not. I presume the same is the
> case with 'links, 'lynx, 'html2text and nil
>
> So, to add to David's suggestion maybe just set both gnus-blocked-images
> and shr-blocked-images to the value of
> notmuch-show-text/html-blocked-images

All right.  I sent another patch that does this.  Thanks, guys!

>
>
> Tomi
>
>
> mm-text-html-renderer is a variable defined in `mm-decode.el'.
> Its value is shr
>
> Documentation:
> Render of HTML contents.
> It is one of defined renderer types, or a rendering function.
> The defined renderer types are:
> `shr': use the built-in Gnus HTML renderer;
> `gnus-w3m': use Gnus renderer based on w3m;
> `w3m': use emacs-w3m;
> `w3m-standalone': use plain w3m;
> `links': use links;
> `lynx': use lynx;
> `w3': use Emacs/W3;
> `html2text': use html2text;
> nil    : use external viewer (default web browser).
>
>
>> d

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Tomi Ollila]

On Thu, Jan 29 2015, Jinwoo Lee <jinwoo68@gmail.com> wrote:

> On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>>
>>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>>
>>>> +	(shr-blocked-images (if notmuch-show-block-remote-images
>>>> +				"."
>>>> +			      shr-blocked-images)))
>>>>      (shr-insert-document dom)
>>>>      t))
>>>
>>> Ideally such a customization would apply to all html renders. I think
>>> Tomi did some experiments with w3m and friends, I _think_ they respect
>>> gnus-blocked-images, but maybe Tomi can comment.
>>
>> I did M-x debug-on-entry RET open-network-stream RET  (or an equivalent of
>> t that in elisp, but the code I did is now lost & forgotten ;/
>>
>> The docstring relevant to the renderers below it at the end of this email.
>>
>> 'gnus-w3m respect gnus-blocked-images
>>
>> I could not run 'w3m on that system... nor 'w3
>>
>> There was no effect with 'w3m-standalone -- in this case I'd think it is up
>> to w3m binary to load external stuff or not. I presume the same is the
>> case with 'links, 'lynx, 'html2text and nil
>>
>> So, to add to David's suggestion maybe just set both gnus-blocked-images
>> and shr-blocked-images to the value of
>> notmuch-show-text/html-blocked-images
>
> All right.  I sent another patch that does this.  Thanks, guys!

Thanks for your contribution. You seem to have taken my suggestion
literally just that it IIRC now only sets those when using shr renderer --
setting of gnus-blocked images should be in other code path... i am not
sure though i am sending this using mobile phi0one terminal and checking
for sure is just too PITA ;\

Tomi

>
>>
>>
>> Tomi
>>
>>
>> mm-text-html-renderer is a variable defined in `mm-decode.el'.
>> Its value is shr
>>
>> Documentation:
>> Render of HTML contents.
>> It is one of defined renderer types, or a rendering function.
>> The defined renderer types are:
>> `shr': use the built-in Gnus HTML renderer;
>> `gnus-w3m': use Gnus renderer based on w3m;
>> `w3m': use emacs-w3m;
>> `w3m-standalone': use plain w3m;
>> `links': use links;
>> `lynx': use lynx;
>> `w3': use Emacs/W3;
>> `html2text': use html2text;
>> nil    : use external viewer (default web browser).
>>
>>
>>> d
> _______________________________________________
> notmuch mailing list
> notmuch@notmuchmail.org
> http://notmuchmail.org/mailman/listinfo/notmuch

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Jinwoo Lee]

On Thu, Jan 29, 2015 at 12:25 PM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
> On Thu, Jan 29 2015, Jinwoo Lee <jinwoo68@gmail.com> wrote:
>
>> On Thu, Jan 29, 2015 at 12:58 AM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>>> On Thu, Jan 29 2015, David Bremner <david@tethera.net> wrote:
>>>
>>>> Jinwoo Lee <jinwoo68@gmail.com> writes:
>>>>
>>>>> +	(shr-blocked-images (if notmuch-show-block-remote-images
>>>>> +				"."
>>>>> +			      shr-blocked-images)))
>>>>>      (shr-insert-document dom)
>>>>>      t))
>>>>
>>>> Ideally such a customization would apply to all html renders. I think
>>>> Tomi did some experiments with w3m and friends, I _think_ they respect
>>>> gnus-blocked-images, but maybe Tomi can comment.
>>>
>>> I did M-x debug-on-entry RET open-network-stream RET  (or an equivalent of
>>> t that in elisp, but the code I did is now lost & forgotten ;/
>>>
>>> The docstring relevant to the renderers below it at the end of this email.
>>>
>>> 'gnus-w3m respect gnus-blocked-images
>>>
>>> I could not run 'w3m on that system... nor 'w3
>>>
>>> There was no effect with 'w3m-standalone -- in this case I'd think it is up
>>> to w3m binary to load external stuff or not. I presume the same is the
>>> case with 'links, 'lynx, 'html2text and nil
>>>
>>> So, to add to David's suggestion maybe just set both gnus-blocked-images
>>> and shr-blocked-images to the value of
>>> notmuch-show-text/html-blocked-images
>>
>> All right.  I sent another patch that does this.  Thanks, guys!
>
> Thanks for your contribution. You seem to have taken my suggestion
> literally just that it IIRC now only sets those when using shr renderer --
> setting of gnus-blocked images should be in other code path... i am not
> sure though i am sending this using mobile phi0one terminal and checking
> for sure is just too PITA ;\

Ouch.  I was stupid.  I'll send an update soon.

>
> Tomi
>
>>
>>>
>>>
>>> Tomi
>>>
>>>
>>> mm-text-html-renderer is a variable defined in `mm-decode.el'.
>>> Its value is shr
>>>
>>> Documentation:
>>> Render of HTML contents.
>>> It is one of defined renderer types, or a rendering function.
>>> The defined renderer types are:
>>> `shr': use the built-in Gnus HTML renderer;
>>> `gnus-w3m': use Gnus renderer based on w3m;
>>> `w3m': use emacs-w3m;
>>> `w3m-standalone': use plain w3m;
>>> `links': use links;
>>> `lynx': use lynx;
>>> `w3': use Emacs/W3;
>>> `html2text': use html2text;
>>> nil    : use external viewer (default web browser).
>>>
>>>
>>>> d
>> _______________________________________________
>> notmuch mailing list
>> notmuch@notmuchmail.org
>> http://notmuchmail.org/mailman/listinfo/notmuch

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Jinwoo Lee]

On Thu, Jan 29, 2015 at 12:57 PM, Jinwoo Lee <jinwoo68@gmail.com> wrote:
> On Thu, Jan 29, 2015 at 12:25 PM, Tomi Ollila <tomi.ollila@iki.fi> wrote:
>> Thanks for your contribution. You seem to have taken my suggestion
>> literally just that it IIRC now only sets those when using shr renderer --
>> setting of gnus-blocked images should be in other code path... i am not
>> sure though i am sending this using mobile phi0one terminal and checking
>> for sure is just too PITA ;\
>
> Ouch.  I was stupid.  I'll send an update soon.
>

Sent another patch.  I couldn't test it with gnus-w3m though because I
don't have w3m on my machine now.

Re: [PATCH] Add a defcustom for whether to block remote images by default.

[Jinwoo Lee]

On Thu, Jan 29, 2015 at 01:39 PM, Jinwoo Lee <jinwoo68@gmail.com> wrote:
> Sent another patch.  I couldn't test it with gnus-w3m though because I
> don't have w3m on my machine now.

I installed w3m and verified that my patch works with gnus-w3m too.