| xdg-email does not parse mailto uris properly for thunderbird |
| |
| When using thunderbird as mailto handler xdg-email translates mailto uris into an 'thunderbird -compose' argument. While to, cc and bcc values are properly enclosed in single quotes this is not the case for subject or body. This breaks functionality and allows to use all thunderbird -compose arguments within a mailto uri, e.g. |
| |
| xdg-email 'mailto:test@example.com?subject=Test,attachment=~/.thunderbird/profiles.ini,message=/home/test/test.txt' |
| |
| translates into |
| |
| thunderbird -compose to='test@example.com,',subject=Test,attachment=~/.thunderbird/profiles.ini,message=/home/test/test.txt |
| |
| with working attachment and message. (And, yes, ~ expands to the home directory.) |
| |
| Upstream-Status: Submitted [https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205] |
| |
| Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> |
| |
| CVE: CVE-2022-4055 |
| |
| |
| Index: xdg-utils-1.1.3/scripts/xdg-email.in |
| =================================================================== |
| --- xdg-utils-1.1.3.orig/scripts/xdg-email.in |
| +++ xdg-utils-1.1.3/scripts/xdg-email.in |
| @@ -30,53 +30,6 @@ _USAGE |
| |
| #@xdg-utils-common@ |
| |
| -run_thunderbird() |
| -{ |
| - local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY |
| - THUNDERBIRD="$1" |
| - MAILTO=$(echo "$2" | sed 's/^mailto://') |
| - echo "$MAILTO" | grep -qs "^?" |
| - if [ "$?" = "0" ] ; then |
| - MAILTO=$(echo "$MAILTO" | sed 's/^?//') |
| - else |
| - MAILTO=$(echo "$MAILTO" | sed 's/^/to=/' | sed 's/?/\&/') |
| - fi |
| - |
| - MAILTO=$(echo "$MAILTO" | sed 's/&/\n/g') |
| - TO=$(/bin/echo -e $(echo "$MAILTO" | grep '^to=' | sed 's/^to=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) |
| - CC=$(/bin/echo -e $(echo "$MAILTO" | grep '^cc=' | sed 's/^cc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) |
| - BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) |
| - SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) |
| - BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) |
| - |
| - if [ -z "$TO" ] ; then |
| - NEWMAILTO= |
| - else |
| - NEWMAILTO="to='$TO'" |
| - fi |
| - if [ -n "$CC" ] ; then |
| - NEWMAILTO="${NEWMAILTO},cc='$CC'" |
| - fi |
| - if [ -n "$BCC" ] ; then |
| - NEWMAILTO="${NEWMAILTO},bcc='$BCC'" |
| - fi |
| - if [ -n "$SUBJECT" ] ; then |
| - NEWMAILTO="${NEWMAILTO},$SUBJECT" |
| - fi |
| - if [ -n "$BODY" ] ; then |
| - NEWMAILTO="${NEWMAILTO},$BODY" |
| - fi |
| - |
| - NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') |
| - DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" |
| - "$THUNDERBIRD" -compose "$NEWMAILTO" |
| - if [ $? -eq 0 ]; then |
| - exit_success |
| - else |
| - exit_failure_operation_failed |
| - fi |
| -} |
| - |
| open_kde() |
| { |
| if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then |
| @@ -130,15 +83,6 @@ open_kde() |
| |
| open_gnome3() |
| { |
| - local client |
| - local desktop |
| - desktop=`xdg-mime query default "x-scheme-handler/mailto"` |
| - client=`desktop_file_to_binary "$desktop"` |
| - echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 |
| - if [ $? -eq 0 ] ; then |
| - run_thunderbird "$client" "$1" |
| - fi |
| - |
| if gio help open 2>/dev/null 1>&2; then |
| DEBUG 1 "Running gio open \"$1\"" |
| gio open "$1" |
| @@ -159,13 +103,6 @@ open_gnome3() |
| |
| open_gnome() |
| { |
| - local client |
| - client=`gconftool-2 --get /desktop/gnome/url-handlers/mailto/command | cut -d ' ' -f 1` || "" |
| - echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 |
| - if [ $? -eq 0 ] ; then |
| - run_thunderbird "$client" "$1" |
| - fi |
| - |
| if gio help open 2>/dev/null 1>&2; then |
| DEBUG 1 "Running gio open \"$1\"" |
| gio open "$1" |
| @@ -231,15 +168,6 @@ open_flatpak() |
| |
| open_generic() |
| { |
| - local client |
| - local desktop |
| - desktop=`xdg-mime query default "x-scheme-handler/mailto"` |
| - client=`desktop_file_to_binary "$desktop"` |
| - echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 |
| - if [ $? -eq 0 ] ; then |
| - run_thunderbird "$client" "$1" |
| - fi |
| - |
| xdg-open "$1" |
| local ret=$? |
| |
| @@ -364,21 +292,6 @@ while [ $# -gt 0 ] ; do |
| shift |
| ;; |
| |
| - --attach) |
| - if [ -z "$1" ] ; then |
| - exit_failure_syntax "file argument missing for --attach option" |
| - fi |
| - check_input_file "$1" |
| - file=`readlink -f "$1"` # Normalize path |
| - if [ -z "$file" ] || [ ! -f "$file" ] ; then |
| - exit_failure_file_missing "file '$1' does not exist" |
| - fi |
| - |
| - url_encode "$file" |
| - options="${options}attach=${result}&" |
| - shift |
| - ;; |
| - |
| -*) |
| exit_failure_syntax "unexpected option '$parm'" |
| ;; |