Regarding the following, written by "Kevin J. McCarthy" on 2019-11-01 at 10:12 
Uhr +0800:
$allow_ansi can enable this, but I recommend reading the option description and thinking very carefully before doing this.

Great, I can confirm this works. So then the challenge becomes to filter out ANSI sequences from the `text/html` part *before* feeding it to the autoviewer, including HTML-encoded ANSI sequences, so that what the autoviewer prints *can* be interpreted as ANSI without fearing whatever malicious codes an attacker may choose to send.

Regarding the problem that the [--- BEGIN PGP ---] badge can get spoofed that way, I have often wondered if there wasn't a better way to make this information accessible, i.e. a status line indicator, combined with a new menu (similar to attachments), which I can invoke to inspect the actual verification of any signature etc.. This then becomes similar to how it's done in the browser. But that's a whole different beast…

Anyway, Akkana, there you have it: find a HTML dumper that can translate HTML to ANSI, and you've got it all, minus the security implications of allowing people to send you email that indirectly controls your terminal beyond just displaying characters.

--
@martinkrafft | https://riot.im/app/#/room/#madduck:madduck.net
an egg has the shortest sex-life of all: if gets laid once; it gets
eaten once. it also has to come in a box with 11 others, and the
only person who will sit on its face is its mother.
spamtraps: madduck.bo...@madduck.net

Attachment: digital_signature_gpg.asc
Description: Digital GPG signature (see http://martin-krafft.net/gpg/sig-policy/999bbcc4/current)

Reply via email to