Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-07-02 Thread Derek Martin
On Mon, Jul 01, 2019 at 05:01:20PM -0500, Derek Martin wrote: > On Sat, Jun 29, 2019 at 03:09:57AM +0200, Vincent Lefevre wrote: > > Machines get rebooted because of (temporary) power > > outage (happens quite often) or because they crash (happens quite > > often too). That's the real world. [...]

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-07-02 Thread Derek Martin
On Mon, Jul 01, 2019 at 05:01:20PM -0500, Derek Martin wrote: > On Sat, Jun 29, 2019 at 03:09:57AM +0200, Vincent Lefevre wrote: > > > This isn't a problem, except that you need to decide what to do when > > > it happens. In such a case your mkdir will fail, and you will have to > > > resort to s

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-07-01 Thread Derek Martin
On Sat, Jun 29, 2019 at 03:09:57AM +0200, Vincent Lefevre wrote: > > I think you missed my point. How does Mutt KNOW /tmp is OK? What if > > it is not on your system? > > /tmp is standard and assumed to be usable (see POSIX, Chapter 10). > A system without /tmp is broken. Which in no way preven

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-28 Thread Vincent Lefevre
On 2019-06-28 12:02:30 -0500, Derek Martin wrote: > On Fri, Jun 28, 2019 at 11:08:06AM +0200, Vincent Lefevre wrote: > > On 2019-06-26 14:36:01 -0500, Derek Martin wrote: > > > On Wed, Jun 26, 2019 at 04:26:44PM +0200, Vincent Lefevre wrote: > > > > On 2019-06-25 14:26:16 -0500, Derek Martin wrote:

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-28 Thread Derek Martin
On Fri, Jun 28, 2019 at 11:08:06AM +0200, Vincent Lefevre wrote: > On 2019-06-26 14:36:01 -0500, Derek Martin wrote: > > On Wed, Jun 26, 2019 at 04:26:44PM +0200, Vincent Lefevre wrote: > > > On 2019-06-25 14:26:16 -0500, Derek Martin wrote: > > > > In some cases it might get cleaned up, but you ca

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-28 Thread Vincent Lefevre
On 2019-06-26 14:36:01 -0500, Derek Martin wrote: > On Wed, Jun 26, 2019 at 04:26:44PM +0200, Vincent Lefevre wrote: > > On 2019-06-25 14:26:16 -0500, Derek Martin wrote: > > > In some cases it might get cleaned up, but you can just have your > > > .profile (or whatever) recreate it when you log in

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-26 Thread Derek Martin
On Wed, Jun 26, 2019 at 04:26:44PM +0200, Vincent Lefevre wrote: > On 2019-06-25 14:26:16 -0500, Derek Martin wrote: > > On Tue, Jun 25, 2019 at 09:11:22PM +0200, Vincent Lefevre wrote: > > > On 2019-06-24 17:18:27 -0500, Derek Martin wrote: > > > > Mutt honors $TMPDIR. You should set it. You shou

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-26 Thread Vincent Lefevre
On 2019-06-25 14:26:16 -0500, Derek Martin wrote: > On Tue, Jun 25, 2019 at 09:11:22PM +0200, Vincent Lefevre wrote: > > On 2019-06-24 17:18:27 -0500, Derek Martin wrote: > > > Mutt honors $TMPDIR. You should set it. You should probably not use > > > /tmp, especially on a multi-user system, especi

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-25 Thread Derek Martin
On Tue, Jun 25, 2019 at 09:11:22PM +0200, Vincent Lefevre wrote: > On 2019-06-24 17:18:27 -0500, Derek Martin wrote: > > Mutt honors $TMPDIR. You should set it. You should probably not use > > /tmp, especially on a multi-user system, especially if you care about > > security (privacy to be more pr

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-25 Thread Vincent Lefevre
On 2019-06-24 17:18:27 -0500, Derek Martin wrote: > Mutt honors $TMPDIR. You should set it. You should probably not use > /tmp, especially on a multi-user system, especially if you care about > security (privacy to be more precise, but that's part of security). > You should probably also not put i

Re: Security: Mutt and mailcap rules

2019-06-25 Thread Vincent Lefevre
On 2019-06-24 10:13:43 +1000, Cameron Simpson wrote: > On 23Jun2019 12:36, vincent lefevre wrote: > > I'm not sure whether this is a good idea. The temporary directory > > may be (and often is) world-writable, and on multi-user machines, > > this increases the risk of vulnerability. For instance,

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-25 Thread Steffen Nurpmeso
Derek Martin wrote in <20190624233654.gb13...@bladeshadow.org>: |On Tue, Jun 25, 2019 at 12:45:02AM +0200, Steffen Nurpmeso wrote: |> Hmm, while i totally support the $TMPDIR environment variable, and |> personally dislike it a lot if i set it and someone simply does |> not adhere to it, and if

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-24 Thread Derek Martin
On Tue, Jun 25, 2019 at 12:45:02AM +0200, Steffen Nurpmeso wrote: > Hmm, while i totally support the $TMPDIR environment variable, and > personally dislike it a lot if i set it and someone simply does > not adhere to it, and if its only for testing purposes.., it shall > be remarked that OpenBSD "r

Re: $TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-24 Thread Steffen Nurpmeso
Derek Martin wrote in <20190624221827.ga13...@bladeshadow.org>: |On Sun, Jun 23, 2019 at 12:36:07PM +0200, Vincent Lefevre wrote: |> On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: |>> Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) |>> before running the shell comman

$TMPDIR (was Re: Security: Mutt and mailcap rules)

2019-06-24 Thread Derek Martin
On Sun, Jun 23, 2019 at 12:36:07PM +0200, Vincent Lefevre wrote: > On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: > > Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) > > before running the shell command with a simple filename? > > I'm not sure whether this is a good ide

Re: Security: Mutt and mailcap rules

2019-06-23 Thread Cameron Simpson
On 23Jun2019 12:36, vincent lefevre wrote: On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) before running the shell command with a simple filename? I'm not sure whether this is a good idea. The temporary directory may

Re: Security: Mutt and mailcap rules

2019-06-23 Thread Vincent Lefevre
On 2019-06-23 14:44:36 +1000, Cameron Simpson wrote: > Were it a simple filename it would all be easy. Maybe a chdir(tmpdir) > before running the shell command with a simple filename? I'm not sure whether this is a good idea. The temporary directory may be (and often is) world-writable, and on mul

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Cameron Simpson
On 22Jun2019 20:29, Kevin J. McCarthy wrote: On Sun, Jun 23, 2019 at 08:55:38AM +1000, Cameron Simpson wrote: I'm happy to try to make some time to understand the mutt code and suggest a patch if there's agreement about this. By the way, please don't mistake our initial pushback against your

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Kevin J. McCarthy
On Sun, Jun 23, 2019 at 08:55:38AM +1000, Cameron Simpson wrote: I'm happy to try to make some time to understand the mutt code and suggest a patch if there's agreement about this. By the way, please don't mistake our initial pushback against your ideas today for pushback against *you* working

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Vincent Lefevre
On 2019-06-22 15:12:37 -0700, Kevin J. McCarthy wrote: > The test field was missing this, but I don't think in practice > anyone has %s in a test field. At least under Debian, with the 562 lines of /etc/mailcap on my machine, perl -ne '/(test *=[^;]*%s[^;\n]*)/ and print "$1\n"' /etc/mailcap r

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Kevin J. McCarthy
On Sun, Jun 23, 2019 at 08:55:38AM +1000, Cameron Simpson wrote: Returning to the quotes-in-mailcap-recipes issue, I'd be all for mutt noticing _and warning_ about mailcap entries with '%s' in them, and maybe doing an aggressive filename sanitisation at that point to provide an _unquoted_ but s

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Cameron Simpson
On 22Jun2019 12:24, vincent lefevre wrote: FYI, due to incorrect mailcap rules, which use '%s' or similar instead of just %s, the filename quoting system in Mutt eventually makes the filename *unquoted*, i.e. reversing its purpose, e.g. "less ''/var/tmp/_.txt''" I've reported a general bug in

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Kevin J. McCarthy
On Sat, Jun 22, 2019 at 07:05:58AM -0700, Kevin J. McCarthy wrote: On Sat, Jun 22, 2019 at 06:49:03AM -0700, Kevin J. McCarthy wrote: No, the setup code is complicated, as you can see from the above listed functions. Send mode directly uses the filename if a nametemplate isn't required. And

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Vincent Lefevre
On 2019-06-22 13:40:36 +0200, Gero Treuner wrote: > I don't want the executable to be bloated, but what do you think about a > script checking mailcap at build time regarding this issue? In Debian, /etc/mailcap is updated by the update-mime script. The check could be done there. And it could also

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Kevin J. McCarthy
On Sat, Jun 22, 2019 at 06:49:03AM -0700, Kevin J. McCarthy wrote: No, the setup code is complicated, as you can see from the above listed functions. Send mode directly uses the filename if a nametemplate isn't required. And interestingly, it looks like the print command would fail in send m

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Kevin J. McCarthy
On Sat, Jun 22, 2019 at 12:24:16PM +0200, Vincent Lefevre wrote: After reading the code, it appears that OPTMAILCAPSANITIZE is not used for %s: else if (*cptr == 's' && filename != NULL) { mutt_buffer_quote_filename (quoted, filename); mutt_buffer_addstr (buf, mutt_b2s (

Re: Security: Mutt and mailcap rules

2019-06-22 Thread Gero Treuner
Hi, On Sat, Jun 22, 2019 at 12:24:16PM +0200, Vincent Lefevre wrote: > FYI, due to incorrect mailcap rules, which use '%s' or similar > instead of just %s, the filename quoting system in Mutt eventually > makes the filename *unquoted*, i.e. reversing its purpose, e.g. > > "less ''/var/tmp/_.txt

Security: Mutt and mailcap rules

2019-06-22 Thread Vincent Lefevre
FYI, due to incorrect mailcap rules, which use '%s' or similar instead of just %s, the filename quoting system in Mutt eventually makes the filename *unquoted*, i.e. reversing its purpose, e.g. "less ''/var/tmp/_.txt''" I've reported a general bug in Debian: https://bugs.debian.org/cgi-bin/b