Opening attachments with embedded spaces in a browser

Opening attachments with embedded spaces in a browser

[Bjørn Mork]

I just found a nasty side effect of an Opera bug: "\" is automatically
turned to "/" without any questions.

This means that Opera is unable to open filenames with emabedded
spaces when used as a viewer for Gnus.  I've added a mailcap entry
like this:

 (mailcap-add "image/jpeg" "opera -remote 'openURL(file://%s)'" t)

This will make Gnus call

 opera -remote 'openURL(file:///tmp/emm.4564CaM/<filename>)'

when viewing the file.  However, if <filename> contains spaces, this
call may look like

 opera -remote 'openURL(file:///tmp/emm.4564CaM/file\ name)'

which Opera, due to the bug in "\" handling, will interpret as

 opera -remote 'openURL(file:///tmp/emm.4564CaM/file/name)'

This can be abused to make Opera open other files than the attachment
when called from Gnus, e.g by embedding a mix of ".." and " " in the
filename.  

The bug has been reported to Opera.  Dunno if it's necessary to do
anything in Gnus, since this is obviously an Opera bug and Opera usage
is by no way a Gnus default.  Just wanted you all to know.

Note that there may be other browsers affected by this, too.


Bjørn
-- 
I've never heard anything as ridiculous as the idea that the Cubans
are tapping your phone.