emacs: quote MML tags in replies

Emacs message-mode uses certain text strings to indicate how to attach
files to outgoing mail.  If these are present in the text of an email,
and a user is tricked into replying to the message, the user’s files
could be exposed.

Edited-by: Pieter Praet <pieter@praet.org>:  Rebased to release branch.

diff --git a/NEWS b/NEWS
index 3d2c2a8484fe856d60b7bcb17b5fdb5e3dcd6dc9..a089e679963d7f0d10dc1b0ed9633f1026a69e07 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,17 @@ Fix error handling in python bindings.
   exceptions to indicate the error condition. Any subsequent calls
   into libnotmuch caused segmentation faults.
 
   exceptions to indicate the error condition. Any subsequent calls
   into libnotmuch caused segmentation faults.
 

+Quote MML tags in replies
+
+  MML tags are text codes that Emacs uses to indicate attachments
+  (among other things) in messages being composed.  The Emacs
+  interface did not quote MML tags in the quoted text of a reply.
+  User could be tricked into replying to a maliciously formatted
+  message and not editing out the MML tags from the quoted text.  This
+  could lead to files from the user's machine being attached to the
+  outgoing message.  The Emacs interface now quotes these tags in
+  reply text, so that they do not effect outgoing messages.
+

 
 Notmuch 0.11 (2012-01-13)
 =========================
 
 Notmuch 0.11 (2012-01-13)
 =========================

diff --git a/emacs/notmuch-mua.el b/emacs/notmuch-mua.el
index 7114e48a4b8ca94223c969cefebcb5f50fde55fa..3e93d7c8bfbf7945dcbc0fc36898a6ba2806e8b0 100644 (file)
--- a/emacs/notmuch-mua.el
+++ b/emacs/notmuch-mua.el
@@ -111,7 +111,12 @@ list."
     (insert body))
   (set-buffer-modified-p nil)
 
     (insert body))
   (set-buffer-modified-p nil)
 

-  (message-goto-body))
+  (message-goto-body)
+  ;; Original message may contain (malicious) MML tags.  We must
+  ;; properly quote them in the reply.  Note that using `point-max'
+  ;; instead of `mark' here is wrong.  The buffer may include user's
+  ;; signature which should not be MML-quoted.
+  (mml-quote-region (point) (point-max)))

 
 (defun notmuch-mua-forward-message ()
   (message-forward)
 
 (defun notmuch-mua-forward-message ()
   (message-forward)

diff --git a/test/emacs b/test/emacs
index db8e4ad87fbd23d37f7efb43b758ab7620d80a5b..2d066ed439d44d297eb92fc6995edb44d92a556c 100755 (executable)
--- a/test/emacs
+++ b/test/emacs
@@ -274,7 +274,6 @@ EOF
 test_expect_equal_file OUTPUT EXPECTED
 
 test_begin_subtest "Quote MML tags in reply"
 test_expect_equal_file OUTPUT EXPECTED
 
 test_begin_subtest "Quote MML tags in reply"

-test_subtest_known_broken

 message_id='test-emacs-mml-quoting@message.id'
 add_message [id]="$message_id" \
            "[subject]='$test_subtest_name'" \
 message_id='test-emacs-mml-quoting@message.id'
 add_message [id]="$message_id" \
            "[subject]='$test_subtest_name'" \