From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sun, 26 May 2019 22:16:02 +0000 (-0400)
Subject: cli/reply: ensure encrypted Subject: line does not leak in the clear
X-Git-Tag: archive/debian/0.29_rc0-1~12
X-Git-Url: https://git.notmuchmail.org/git?p=notmuch;a=commitdiff_plain;h=b7b553e732baed620f6688570829a4d46dd5f6e5;hp=b7b553e732baed620f6688570829a4d46dd5f6e5

cli/reply: ensure encrypted Subject: line does not leak in the clear

Now that we can decrypt headers, we want to make sure that clients
using "notmuch reply" to prepare a reply don't leak cleartext in their
subject lines.  In particular, the ["reply-headers"]["Subject"] should
by default show the external Subject.

A replying MUA that intends to protect the Subject line should show
the user the Subject from ["original"]["headers"]["Subject"] instead
of using ["reply-headers"]["Subject"].

This minor asymmetry with "notmuch show" is intentional.  While both
tools always render the cleartext subject line when they know it (in
["headers"]["Subject"] for "notmuch show" and in
["original"]["headers"]["Subject"] for "notmuch reply"), "notmuch
reply" should never leak something that should stay under encrypted
cover in "reply-headers".

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
---