Package: pkg-perl-tools
Version: 0.82
Severity: normal
Tags: patch
Dear Maintainer,
While creating thirteen ITP messages over the last week, I noticed that
`dpt gen-itp` emits a `From:` header in which the encoded-word covers the
entire address, and not just the display name:
From: =?UTF-8?B?RWRtdW5kIExvZGV3aWprcyA8ZWRtdW5kQHByb3RlYW1haWwuY29tPg==?=
There is no address left that can be parsed. RFC 2047 section 5 permits an
encoded-word in the _phrase_ of an address, but nowhere inside an `addr-spec`.
scripts/gen-itp:57
say 'From: ' . encode("MIME-Header", $changelog->{Maintainer});
A second problem appears with a non-ASCII name. $changelog->{Maintainer} is a
byte string, so encode() re-encodes it as though it were characters:
$ perl -MEncode -e 'print encode("MIME-Header", "Jörg Müller
<[email protected]>")'
=?UTF-8?B?SsODwrZyZyBNw4PCvGxsZXIgPGpAZXhhbXBsZS5vcmc+?=
which decodes to "Jörg Müller <[email protected]>". The Owner: field at line 79
already does decode('UTF-8', ...) on the same string.
Pure-ASCII names are encoded, too. Though that is legal, it makes the header
unreadable for no benefit, if you were to inspect headers, say, on disk.
The attached patch adds `mime_encode_address()`, which splits the phrase from
the `angle-addr`, decodes to characters, and encodes the phrase only when it is
not ASCII. An ASCII phrase containing RFC 5322 specials (dot, comma, colon, etc)
is quoted, rather than encoded, for the same reason of raw-message-readability
as above.
Results:
Edmund Lodewijks <[email protected]> unchanged
Jörg Müller <[email protected]>
=?UTF-8?B?SsO2cmcgTcO8bGxlcg==?= <[email protected]>
Foo Bar Jr., Ltd <[email protected]> "Foo Bar Jr., Ltd" <[email protected]>
[email protected] unchanged
<[email protected]> unchanged
Checked with perl -c.
Kind regards,
Edmund Lodewijks
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable'), (1, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.105+deb13-amd64 (SMP w/3 CPU threads; PREEMPT)
Locale: LANG=en_ZA.UTF-8, LC_CTYPE=en_ZA.UTF-8 (charmap=UTF-8),
LANGUAGE=en_ZA:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages pkg-perl-tools depends on:
ii curl 8.14.1-2+deb13u4
ii debhelper 13.31~bpo13+1
ii devscripts 2.26.11~bpo13+1
ii dh-make-perl 0.128
ii git 1:2.47.3-0+deb13u1
ii git-buildpackage 0.9.38
ii libdatetime-perl 2:1.65-1+b2
ii libdebian-source-perl 0.128
ii libdpkg-perl 1.22.22
ii libgit-repository-perl 1.325-3
ii libgitlab-api-v4-perl 0.27-1
ii libipc-run-perl 20231003.0-2
ii libjson-xs-perl 4.040-1~deb13u1
ii libpath-tiny-perl 0.148-1
ii libproc-invokeeditor-perl 1.13-3
ii librt-client-rest-perl 1:0.72-1
ii libtry-tiny-perl 0.32-1
ii libutf8-all-perl 0.024-3
ii lintian 2.122.0
ii openssh-client [ssh-client] 1:10.0p1-7+deb13u4
ii perl 5.40.1-6
ii pristine-tar 1.50+nmu2
ii quilt 0.68-1
Versions of packages pkg-perl-tools recommends:
ii autodep8 0.29
ii autopkgtest 5.49
ii cme 1.041-1
ii libarray-utils-perl 0.5-3
ii libconfig-model-dpkg-perl 3.014
ii libconfig-model-perl 2.155-1
ii libdebian-copyright-perl 0.2-6
ii libfile-slurp-perl 9999.32-2
ii libmime-lite-perl 3.033-2
ii libmodule-inspector-perl 1.05-3
ii libnet-github-perl 1.05-1
ii libparallel-forkmanager-perl 2.03-1
ii libsoap-lite-perl 1.27-3
ii libterm-readline-gnu-perl 1.46-1+b3
ii libwww-mechanize-perl 2.19-1
ii libyaml-libyaml-perl 0.903.0+ds-1
ii myrepos 1.20180726
ii perl [libmodule-corelist-perl] 5.40.1-6
ii postgresql-client 17+278
ii postgresql-client-17 [postgresql-client] 17.11-0+deb13u1
ii sensible-utils 0.0.25
ii w3m 0.5.3+git20230121-2.1
Versions of packages pkg-perl-tools suggests:
pn bc <none>
pn cdbs <none>
pn duck <none>
pn lintian-brush <none>
pn moreutils <none>
pn perl-depends <none>
ii python3 3.13.5-1
pn python3-launchpadlib <none>
-- no debconf information
--- a/scripts/gen-itp
+++ b/scripts/gen-itp
@@ -54,7 +54,7 @@
$lang = 'FIXME';
}
-say 'From: ' . encode("MIME-Header", $changelog->{Maintainer});
+say 'From: ' . mime_encode_address( $changelog->{Maintainer} );
if ( $ENV{SECRETLY_ITP} ) {
say "To: Debian Bug Tracking System <quiet\@bugs.debian.org>";
}
@@ -123,6 +123,29 @@
say '--';
say 'Generated with the help of dpt-gen-itp(1) from pkg-perl-tools.';
+# RFC 2047 section 5 allows an encoded-word in the display name of an address
+# but not anywhere inside the addr-spec, so encode the display name alone, and
+# only when it actually needs it.
+sub mime_encode_address {
+ my ($address) = @_;
+ $address = decode( 'UTF-8', $address );
+ $address =~ s/^\s+//;
+ $address =~ s/\s+$//;
+
+ my ( $phrase, $angle_addr ) = $address =~ m/^(.*?)\s*(<[^>]*>)$/
+ or return $address;
+ return $angle_addr unless length $phrase;
+
+ if ( $phrase =~ m/[^\x00-\x7f]/ ) {
+ $phrase = encode( 'MIME-Header', $phrase );
+ }
+ elsif ( $phrase =~ m/[()<>\@,;:\\".\[\]]/ ) {
+ $phrase =~ s/(["\\])/\\$1/g;
+ $phrase = qq("$phrase");
+ }
+ return "$phrase $angle_addr";
+}
+
__END__
=head1 NAME
