Re: Security: Mutt and mailcap rules

2019-06-23 Thread Cameron Simpson
On 23Jun2019 12:36, vincent lefevre wrote: On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) before running the shell command with a simple filename? I'm not sure whether this is a good idea. The temporary directory may

Re: meaning of number of lines in the message (%l in index_format)

2019-06-23 Thread Kurt Hackenberg
On 2019-06-23 06:31, Vincent Lefevre wrote: ...the provided "Lines:" header is not necessarily reliable. Right. I've seen it wrong many times. Not from Mutt--when Mutt writes a message to an mbox file, it generates Lines: and Content-Length:, both correctly. But Mutt is not the only

Re: Ticket 151 - strip leading '-' for mailcap sanitize

2019-06-23 Thread Kevin J. McCarthy
On Sun, Jun 23, 2019 at 11:43:56AM +0200, Eike Rathke wrote: Ah ok I thought sanitizing was also used when saving attachments. As was mentioned elsewhere prefixing './' might be best if it starts with '-' and a path is not prepended (can that even happen?). Only in send mode (i.e. from the

Re: Security: Mutt and mailcap rules

2019-06-23 Thread Vincent Lefevre
On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: > Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) > before running the shell command with a simple filename? I'm not sure whether this is a good idea. The temporary directory may be (and often is) world-writable, and on

Re: meaning of number of lines in the message (%l in index_format)

2019-06-23 Thread Vincent Lefevre
On 2019-06-22 21:53:11 -0400, Kurt Hackenberg wrote: > On 2019-06-22 16:47, Vincent Lefevre wrote: > > > The manual says: > > > > %l number of lines in the message > > (does not work with maildir, mh, > >

Re: Ticket 151 - strip leading '-' for mailcap sanitize

2019-06-23 Thread Eike Rathke
Hi Kevin, On Friday, 2019-06-21 13:26:22 -0700, Kevin J. McCarthy wrote: > On Fri, Jun 21, 2019 at 10:03:23PM +0200, Eike Rathke wrote: > > I would not like to have all '-' replaced by '_' in attachments > > (specifically I personally use '-' instead of '_' except when I need > > some