[sup-devel] [PATCH] Bugfix: Charset conversion needs to take place *after* verifying inline GPG signatures

* [sup-devel] [PATCH] Bugfix: Charset conversion needs to take place *after* verifying inline GPG signatures
@ 2010-06-04  9:59 Michael Stapelberg
  2010-06-05  2:55 ` Rich Lane
  0 siblings, 1 reply; 2+ messages in thread
From: Michael Stapelberg @ 2010-06-04  9:59 UTC (permalink / raw)
  To: sup-devel

[-- Attachment #1: Type: text/plain, Size: 299 bytes --]

Hi,

still fixing some inline GPG problems ;-). This one is a little subtle: If the
message arrives in a different encoding than UTF-8 (shame on the sender), the
verification will fail because sup modifies the message by converting it to
UTF-8. The attached patch fixes this.

Best regards,
Michael

[-- Attachment #2: 0001-Bugfix-Charset-conversion-needs-to-take-place-after-.patch --]
[-- Type: application/octet-stream, Size: 2799 bytes --]

From d027da3a16f4539fd3d9d6d57719eb28262ba479 Mon Sep 17 00:00:00 2001
From: Michael Stapelberg <michael@stapelberg.de>
Date: Fri, 4 Jun 2010 11:51:59 +0200
Subject: [PATCH] Bugfix: Charset conversion needs to take place *after* verifying inline GPG signatures

Otherwise non-UTF-8 messages (especially seen from people using windows)
are verified as having a bad signature even though it is valid (because
the message was converted and thus touched before verifying)
---
 lib/sup/message.rb |   25 ++++++++++++++++---------
 1 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/lib/sup/message.rb b/lib/sup/message.rb
index 521f00f..396f01a 100644
--- a/lib/sup/message.rb
+++ b/lib/sup/message.rb
@@ -525,19 +525,24 @@ private
 
       ## otherwise, it's body text
       else
-        ## if there's no charset, use the current encoding as the charset.
-        ## this ensures that the body is normalized to avoid non-displayable
-        ## characters
+        ## Decode the body, charset conversion will follow either in
+        ## inline_gpg_to_chunks (for inline GPG signed messages) or
+        ## a few lines below (messages without inline GPG)
+        body = m.body ? m.decode : ""
+
+        ## Check for inline-PGP
+        chunks = inline_gpg_to_chunks body, $encoding, (m.charset || $encoding)
+        return chunks if chunks
+
         if m.body
+          ## if there's no charset, use the current encoding as the charset.
+          ## this ensures that the body is normalized to avoid non-displayable
+          ## characters
           body = Iconv.easy_decode($encoding, m.charset || $encoding, m.decode)
         else
           body = ""
         end
 
-        ## Check for inline-PGP
-        chunks = inline_gpg_to_chunks body.split("\n")
-        return chunks if chunks
-
         text_to_chunks(body.normalize_whitespace.split("\n"), encrypted)
       end
     end
@@ -546,13 +551,15 @@ private
   ## looks for gpg signed (but not encrypted) inline  messages inside the
   ## message body (there is no extra header for inline GPG) or for encrypted
   ## (and possible signed) inline GPG messages
-  def inline_gpg_to_chunks lines
+  def inline_gpg_to_chunks body, encoding_to, encoding_from
+    lines = body.split("\n")
     gpg = lines.between(GPG_SIGNED_START, GPG_SIGNED_END)
     if !gpg.empty?
       msg = RMail::Message.new
       msg.body = gpg.join("\n")
 
-      sig = lines.between(GPG_SIGNED_START, GPG_SIG_END)
+      body = Iconv.easy_decode(encoding_to, encoding_from, body)
+      sig = body.split("\n").between(GPG_SIGNED_START, GPG_SIG_END)
       payload = RMail::Message.new
       payload.body = sig[1, sig.size-2].join("\n")
       return [CryptoManager.verify(nil, msg, false), message_to_chunks(payload)].flatten.compact
-- 
1.7.1


[-- Attachment #3: Type: text/plain, Size: 143 bytes --]

_______________________________________________
Sup-devel mailing list
Sup-devel@rubyforge.org
http://rubyforge.org/mailman/listinfo/sup-devel

^ permalink raw reply	[flat|nested] 2+ messages in thread