[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Jonathan Marten]

https://bugs.kde.org/show_bug.cgi?id=390002

Jonathan Marten  changed:

   What|Removed |Added

 CC||freekdekru...@kde.nl

--- Comment #11 from Jonathan Marten  ---
*** Bug 435504 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Ingo Klöcker]

https://bugs.kde.org/show_bug.cgi?id=390002

Ingo Klöcker  changed:

   What|Removed |Added

  Latest Commit||https://invent.kde.org/pim/
   ||messagelib/commit/3f53b7394
   ||ffc75264442a2dd09e845a7a80f
   ||3dae
 Status|ASSIGNED|RESOLVED
 Resolution|--- |FIXED

--- Comment #10 from Ingo Klöcker  ---
Git commit 3f53b7394ffc75264442a2dd09e845a7a80f3dae by Ingo Klöcker, on behalf
of Jonathan Marten.
Committed on 22/02/2022 at 07:51.
Pushed by kloecker into branch 'master'.

Fix MS Word attachments being detected as encrypted

Caused by EncryptedBodyPartFormatter (via GpgME upstream) being too
enthusiastic and detecting the binary data as PGP encrypted.  Only
enable this formatter for binary body parts explicitly declared as
encrypted by their MIME type.  See the referenced bug for more
information.

M  +17   -0mimetreeparser/autotests/basicobjecttreeparsertest.cpp
M  +1-0mimetreeparser/autotests/basicobjecttreeparsertest.h
A  +61   -0mimetreeparser/autotests/data/binary-attachment-not-pgp.mbox
M  +2-3   
mimetreeparser/autotests/data/openpgp-inline-encrypted-with-attachment.mbox.tree
M  +27   -10   mimetreeparser/src/bodyformatter/encrypted.cpp
M  +12   -4mimetreeparser/src/bodyformatter/encrypted.h
M  +2-2mimetreeparser/src/bodypartformatter.cpp

https://invent.kde.org/pim/messagelib/commit/3f53b7394ffc75264442a2dd09e845a7a80f3dae

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Bug Janitor Service]

https://bugs.kde.org/show_bug.cgi?id=390002

Bug Janitor Service  changed:

   What|Removed |Added

 Ever confirmed|0   |1
 Status|REPORTED|ASSIGNED

--- Comment #9 from Bug Janitor Service  ---
A possibly relevant merge request was started @
https://invent.kde.org/pim/messagelib/-/merge_requests/83

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Friedrich W. H. Kossebau]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #8 from Friedrich W. H. Kossebau  ---
Thanks for the quick reply and research, Ingo. Okay, so we need to fix/improve
things on our side.  Only on my schedule for next week#'s WE to continue here,
so anyone is invited to have a look & go themselves until ;)

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Ingo Klöcker]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #7 from Ingo Klöcker  ---
I had a quick look at what GpgME::data().type() is doing. It looks as if any
data that starts with something that looks even remotely like a valid OpenPGP
packet is identified as some OpenPGP data. The code trying to identifying the
data basically only looks at the first byte. If bit 7 is set, then there is
a chance of 31:127 that the data is identified as some kind of OpenPGP data and
a chance of 15:127 that the data is identified as GpgME::Data::PGPOther.

There is special code to prevent PNG files starting with "\x89PNG" from being
identified as some kind of OpenPGP data, but that's the only blacklisting
that's done.

Given this, I conclude that GpgME::data().type() is not suitable for checking
if arbitrary data is some kind of OpenPGP data. In my opinion, it should only
be used on data if there are good reasons to assume that this data is indeed
OpenPGP data, but if it's not clear what kind of OpenPGP data.

For identifying data of type application/octet-stream, we should use file type
detection provided by other libraries. Isn't there something in KF5 maybe in
KIO that determines the mimetype? Or are we doing the GpgME::data().type() only
after KIO returns application/octet-stream?

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Antonio Rojas]

https://bugs.kde.org/show_bug.cgi?id=390002

Antonio Rojas  changed:

   What|Removed |Added

 CC||aro...@archlinux.org

--- Comment #6 from Antonio Rojas  ---
*** Bug 406808 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Friedrich W. H. Kossebau]

https://bugs.kde.org/show_bug.cgi?id=390002

Friedrich W. H. Kossebau  changed:

   What|Removed |Added

 CC||kloec...@kde.org,
   ||kosse...@kde.org

--- Comment #5 from Friedrich W. H. Kossebau  ---
Bug is still present in master branches of today, for the same reason as
mentioned in comment 3.

Pulling Ingo as a representative(? if not, please forward) of GPGMe into the
discussion, to ask whether this should be also considered a bug in GPGMe that a
msword or odt data blob is detected to be of type GpgME::Data::PGPOther? Works
properly to report GpgME::Data::Unknown e.g. for PDF data blobs for me.

On our side should registering EncryptedBodyPartFormatter as handler for
"application/octet-stream" indeed be reconsidered and probably replaced with
some special handling for known cases where the content type is not properly
set to "text/pgp"?

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Jonathan Marten]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #4 from Jonathan Marten  ---
See also bug 435504 for possibly the same effect with ODT files.

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Jonathan Marten]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #3 from Jonathan Marten  ---
Have done some investigating and found that the root cause is the MS Word
binary format being detected as PGP encrypted data, in
EncryptedBodyPartFormatter::process().  The result of GpgME::data().type() is
returned as GpgME::Data::PGPOther for the attachment part.

One solution that I have found so far is to remove the preset formatter

 insert(QStringLiteral("application/octet-stream"),
EncryptedBodyPartFormatter::create());

from
BodyPartFormatterFactoryPrivate::messageviewer_create_builtin_bodypart_formatters().
 The detection from the binary data is too sensitive for the catch-all MIME
type.  This still allows PGP encrypted parts to be detected as long as they
have the correct MIME type (which any decent sending mailer should use, it's
2019 now).

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Jonathan Marten]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #2 from Jonathan Marten  ---
Created attachment 110399
  --> https://bugs.kde.org/attachment.cgi?id=110399=edit
Test message - open in KMail View or import

-- 
You are receiving this mail because:
You are watching all bug changes.

[kmail2] [Bug 390002] Message viewer: attached .doc file is shown as encrypted

[Jonathan Marten]

https://bugs.kde.org/show_bug.cgi?id=390002

--- Comment #1 from Jonathan Marten  ---
Created attachment 110398
  --> https://bugs.kde.org/attachment.cgi?id=110398=edit
Screen shot 2 - After clicking on "Decrypt message"

-- 
You are receiving this mail because:
You are watching all bug changes.