`write'++: !interactive: urlxenc() attachment paths (Ralph Corderoy)..
commit7adcf99cab34804d409d017967ea6a89a66fe1a8
authorSteffen (Daode) Nurpmeso <steffen@sdaoden.eu>
Thu, 6 Oct 2016 15:45:33 +0000 (6 17:45 +0200)
committerSteffen (Daode) Nurpmeso <steffen@sdaoden.eu>
Thu, 6 Oct 2016 15:49:05 +0000 (6 17:49 +0200)
treee7e0937cdd1ed9ae5341f10a8fe1aa335809b2e8
parent0ef429135140295ded624010eb5e5e906eac5996
`write'++: !interactive: urlxenc() attachment paths (Ralph Corderoy)..

Heck.  Yes, i sneaked into the nmh ML.  Sigh.

So in the following, in non-interactive mode, a `write' would
blindly invoke the shell when saving the second attachment, which
seems like something really bad to-do.  And any path specification
in an attachment filename smells fishy, too.

All this can be circumvented by calling urlxenc() on the
attachment filename, and so henceforth S-nail will place in the
_current_ directory %2E.%2Flaber.txt,
%7Cecho%20hey_%24SHELL and A, which is at least reliable
behaviour.  The future has to bring much more control.

  MIME-Version: 1.0
  Content-Type: multipart/mixed;
   boundary="=-=4ALQnuF2gp2qHOI9MnFB4Li4_vLarc5l-p0u=-="

  This is a multi-part message in MIME format.

  --=-=4ALQnuF2gp2qHOI9MnFB4Li4_vLarc5l-p0u=-=
  Content-Type: text/plain; charset=us-ascii
  Content-Disposition: attachment; filename="../laber.txt"

  boing

  --=-=4ALQnuF2gp2qHOI9MnFB4Li4_vLarc5l-p0u=-=
  Content-Type: text/plain; charset=us-ascii
  Content-Disposition: attachment; filename="|echo hey_$SHELL"

  boom

  --=-=4ALQnuF2gp2qHOI9MnFB4Li4_vLarc5l-p0u=-=
  Content-Type: text/plain; charset=us-ascii; name*=UTF-8''%41%00%42
  Content-Disposition: attachment; filename*=UTF-8''%41%00%42

  tschak

  --=-=4ALQnuF2gp2qHOI9MnFB4Li4_vLarc5l-p0u=-=--
send.c