Restrict mailto header fields using mailto_allow.

By default, only the body and subject fields are allowed.  These can
be changed with the mailto_allow and unmailto_allow commands.

diff --git a/doc/manual.xml.head b/doc/manual.xml.head
index 14f90067df7415ecb2990ecf051d16c5a13e949b..54c96a0e948fb75c93e27c8db7a0347ca524d26b 100644 (file)
--- a/doc/manual.xml.head
+++ b/doc/manual.xml.head
@@ -4703,6 +4703,37 @@ set index_format="%4C %Z %{%b %d} %-15.15L (%?l?%4l&amp;%4c?)%*  %s"</screen>
 
 </sect1>
 
+<sect1 id="mailto-allow">
+<title>Control allowed header fields in a mailto: URL</title>
+
+<para>Usage:</para>
+
+<cmdsynopsis>
+<command>mailto_allow</command>
+<group choice="req">
+<arg choice="plain">
+<replaceable class="parameter">*</replaceable>
+</arg>
+<arg choice="plain" rep="repeat">
+<replaceable class="parameter">header-field</replaceable>
+</arg>
+</group>
+</cmdsynopsis>
+
+<para>
+As a security measure, Mutt will only add user-approved header fields from a
+<literal>mailto:</literal> URL.  This is necessary since Mutt will handle
+certain header fields, such as <literal>Attach:</literal>, in a special way.
+The <literal>mailto_allow</literal> and <literal>unmailto_allow</literal>
+commands allow the user to modify the list of approved headers.
+</para>
+<para>
+Mutt initializes the default list to contain only the <literal>Subject</literal>
+and <literal>body</literal> header fields, which are the only requirement specified
+by the <literal>mailto:</literal> specification in RFC2368.
+</para>
+</sect1>
+
 </chapter>
 
 <chapter id="advancedusage">

diff --git a/doc/muttrc.man.head b/doc/muttrc.man.head
index 0b5658cba267847fdef0fc6b8ba44206d79f825e..b237c5a22469f6116dc8492094eb019361592371 100644 (file)
--- a/doc/muttrc.man.head
+++ b/doc/muttrc.man.head
@@ -413,6 +413,16 @@ in the index. See the Mutt manual for details.
 This command will remove all hooks of a given type, or all hooks
 when \(lq\fB*\fP\(rq is used as an argument.  \fIhook-type\fP
 can be any of the \fB-hook\fP commands documented above.
+.PP
+.nf
+\fBmailto_allow\fP \fIheader-field\fP [ ... ]
+\fBunmailto_allow\fP [ \fB*\fP | \fIheader-field\fP ... ]
+.fi
+.IP
+These commands allow the user to modify the list of allowed header
+fields in a \fImailto:\fP URL that Mutt will include in the
+the generated message.  By default the list contains only
+\fBsubject\fP and \fBbody\fP, as specified by RFC2368.
 .SH PATTERNS
 .PP
 In various places with mutt, including some of the above mentioned

diff --git a/globals.h b/globals.h
index 6b614c6c5e12376f48535438baf0e7a4c3ec3a4d..abefade3d1423e253e8ec5422259d7759d03ea9f 100644 (file)
--- a/globals.h
+++ b/globals.h
@@ -164,6 +164,7 @@ WHERE LIST *InlineAllow INITVAL(0);
 WHERE LIST *InlineExclude INITVAL(0);
 WHERE LIST *HeaderOrderList INITVAL(0);
 WHERE LIST *Ignore INITVAL(0);
+WHERE LIST *MailtoAllow INITVAL(0);
 WHERE LIST *MimeLookupList INITVAL(0);
 WHERE LIST *UnIgnore INITVAL(0);
 

diff --git a/init.c b/init.c
index 27e349688ba2b939d317993149762635d75629fe..72537ddc176e6da6bde9e7d0d891b2d8e2ca553c 100644 (file)
--- a/init.c
+++ b/init.c
@@ -3085,6 +3085,15 @@ void mutt_init (int skip_sys_rc, LIST *commands)
 
   mutt_init_history ();
 
+  /* RFC2368, "4. Unsafe headers"
+   * The creator of a mailto URL cannot expect the resolver of a URL to
+   * understand more than the "subject" and "body" headers. Clients that
+   * resolve mailto URLs into mail messages should be able to correctly
+   * create RFC 822-compliant mail messages using the "subject" and "body"
+   * headers.
+   */
+  add_to_list(&MailtoAllow, "body");
+  add_to_list(&MailtoAllow, "subject");
   
   
   

diff --git a/init.h b/init.h
index 52cbbf01e3627f27e96c74d0091997033594ecd7..8b581f1979dc5d15f931b744a9e7aaf159218424 100644 (file)
--- a/init.h
+++ b/init.h
@@ -3723,6 +3723,8 @@ const struct command_t Commands[] = {
   { "macro",           mutt_parse_macro,       0 },
   { "mailboxes",       mutt_parse_mailboxes,   M_MAILBOXES },
   { "unmailboxes",     mutt_parse_mailboxes,   M_UNMAILBOXES },
+  { "mailto_allow",    parse_list,             UL &MailtoAllow },
+  { "unmailto_allow",  parse_unlist,           UL &MailtoAllow },
   { "message-hook",    mutt_parse_hook,        M_MESSAGEHOOK },
   { "mbox-hook",       mutt_parse_hook,        M_MBOXHOOK },
   { "mime_lookup",     parse_list,     UL &MimeLookupList },

diff --git a/url.c b/url.c
index aba6031130ce30a1013a2565c0918329b5111acd..42a6e09028437d261a13b72e0090913b41e7ca33 100644 (file)
--- a/url.c
+++ b/url.c
@@ -283,21 +283,35 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
     if (url_pct_decode (value) < 0)
       goto out;
 
-    if (!ascii_strcasecmp (tag, "body"))
+    /* Determine if this header field is on the allowed list.  Since Mutt
+     * interprets some header fields specially (such as
+     * "Attach: ~/.gnupg/secring.gpg"), care must be taken to ensure that
+     * only safe fields are allowed.
+     *
+     * RFC2368, "4. Unsafe headers"
+     * The user agent interpreting a mailto URL SHOULD choose not to create
+     * a message if any of the headers are considered dangerous; it may also
+     * choose to create a message with only a subset of the headers given in
+     * the URL.
+     */
+    if (mutt_matches_ignore(tag, MailtoAllow))
     {
-      if (body)
-       mutt_str_replace (body, value);
-    }
-    else
-    {
-      char *scratch;
-      size_t taglen = mutt_strlen (tag);
-     
-      safe_asprintf (&scratch, "%s: %s", tag, value);
-      scratch[taglen] = 0; /* overwrite the colon as mutt_parse_rfc822_line expects */
-      value = skip_email_wsp(&scratch[taglen + 1]);
-      mutt_parse_rfc822_line (e, NULL, scratch, value, 1, 0, 0, &last);
-      FREE (&scratch);
+      if (!ascii_strcasecmp (tag, "body"))
+      {
+       if (body)
+         mutt_str_replace (body, value);
+      }
+      else
+      {
+       char *scratch;
+       size_t taglen = mutt_strlen (tag);
+
+       safe_asprintf (&scratch, "%s: %s", tag, value);
+       scratch[taglen] = 0; /* overwrite the colon as mutt_parse_rfc822_line expects */
+       value = skip_email_wsp(&scratch[taglen + 1]);
+       mutt_parse_rfc822_line (e, NULL, scratch, value, 1, 0, 0, &last);
+       FREE (&scratch);
+      }
     }
   }