I did some digging. We're dealing with two cases, both ugly (yay).

Case 1: multipart/mixed with INLINE PGP

This is was my previous email exploited.

The part that looks and parses INLINE messages iterates over an DOM Tree
which leads to the case were the first two mime parts are skipped but it
triggers on the mime part with the signature from someone else. That
part however has no data before the signed part, so it does not
recognize it as partially signed.

The patch attached throws this out and then this happens when displaying
the previous mail:

Enigmail: *Parts of the message have NOT been signed or encrypted*

##### My text

##### Mailinglist Part

********* *BEGIN ENCRYPTED or SIGNED PART* *********
##### Reply from Patrick
********** *END ENCRYPTED or SIGNED PART* **********
##### 2th Mailinglist Part

I'm sure that there is a reason for the way its done and this breaks
lots of things, but its not obvious to me. The patch is just to
illustrate what the problem is.


Case 2: At least one PGP/MIME Part with other text/ or messages/ parts

mimeVerify does have a variable called partiallySigned that, if set to
true would set the PARTIALLY_PGP flag. However there is no case where
its set to true. And I'm not certain what the best way would be too do
that. And I'm not clear whether it could be displayed like the above or not.


-- gnoxter

commit ec91af8d6caeacca590a455e322282f2135d0e41
Author: Janosch Rux <[email protected]>
Date:   Mon Mar 7 01:29:22 2016 +0100

    This could be a proper commit message

diff --git a/ui/content/enigmailMessengerOverlay.js b/ui/content/enigmailMessengerOverlay.js
index 42f8832..c7d3436 100644
--- a/ui/content/enigmailMessengerOverlay.js
+++ b/ui/content/enigmailMessengerOverlay.js
@@ -777,35 +777,22 @@ Enigmail.msg = {
 
     if (!bodyElement) return;
 
-    let topElement = bodyElement;
     var findStr = /* interactive ? null : */ "-----BEGIN PGP";
     var msgText = null;
     var foundIndex = -1;
 
-    if (bodyElement.firstChild) {
-      let node = bodyElement.firstChild;
-      while (node) {
-        if (node.nodeName == "DIV") {
-          foundIndex = node.textContent.indexOf(findStr);
+    foundIndex = bodyElement.textContent.indexOf(findStr);
 
-          if (foundIndex >= 0) {
-            if (node.textContent.indexOf(findStr + " LICENSE AUTHORIZATION") == foundIndex)
-              foundIndex = -1;
-          }
-          if (foundIndex >= 0) {
-            bodyElement = node;
-            break;
-          }
-        }
-        node = node.nextSibling;
-      }
-    }
+    if (foundIndex >= 0) {
+        if (bodyElement.textContent.indexOf(findStr + " LICENSE AUTHORIZATION") == foundIndex)
+            foundIndex = -1;
+  }
 
     if (foundIndex >= 0) {
       if (Enigmail.msg.savedHeaders["content-type"].search(/^text\/html/i) === 0) {
         let p = Components.classes["@mozilla.org/parserutils;1"].createInstance(Components.interfaces.nsIParserUtils);
         const de = Components.interfaces.nsIDocumentEncoder;
-        msgText = p.convertToPlainText(topElement.innerHTML, de.OutputRaw | de.OutputBodyOnly, 0);
+        msgText = p.convertToPlainText(bodyElementt.innerHTML, de.OutputRaw | de.OutputBodyOnly, 0);
       }
       else {
         msgText = bodyElement.textContent;
@@ -1181,7 +1168,7 @@ Enigmail.msg = {
               foundIndex = -1;
           }
           if (foundIndex >= 0) {
-            node.innerHTML = EnigmailFuncs.formatPlaintextMsg(EnigmailData.convertToUnicode(messageContent, charset));
+            bodyElement.innerHTML = EnigmailFuncs.formatPlaintextMsg(EnigmailData.convertToUnicode(messageContent, charset));
             return;
           }
         }
_______________________________________________
enigmail-users mailing list
[email protected]
To unsubscribe or make changes to your subscription click here:
https://admin.hostpoint.ch/mailman/listinfo/enigmail-users_enigmail.net

Reply via email to