mml attached filename with double-quote

mml attached filename with double-quote

[Kevin Ryde]

[-- Attachment #1: Type: text/plain, Size: 555 bytes --]

I attached a filename /tmp/" (a double-quote) and on sending it went out
with file /tmp/\" (backslash and double-quote) attached instead.

This was very bad as I had private information in that \" file!
:-)

I think mml-read-tag should apply a `read'.  I don't suppose anyone
sends bizarrely named files, but it doesn't look hard to make it work.

2010-03-17  Kevin Ryde  <user42@zip.com.au>

	* mml.el (mml-read-tag): Unquote values with `read' to reverse
	prin1 in mml-insert-tag (just stripping the quotes gave wrong
	value if any backslash escapes).


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: mml.el.read-tag.diff --]
[-- Type: text/x-diff, Size: 558 bytes --]

--- mml.el.~7.80.~	2010-03-17 08:42:21.000000000 +1100
+++ mml.el	2010-03-17 11:35:42.000000000 +1100
@@ -392,8 +392,8 @@
       (skip-chars-forward "= \t\n")
       (setq val (buffer-substring-no-properties
 		 (point) (progn (forward-sexp 1) (point))))
-      (when (string-match "^\"\\(.*\\)\"$" val)
-	(setq val (match-string 1 val)))
+      (when (string-match "\\`\"" val)
+	(setq val (read val))) ;; inverse of prin1 in mml-insert-tag
       (push (cons (intern elem) val) contents)
       (skip-chars-forward " \t\n"))
     (goto-char (match-end 0))

Re: mml attached filename with double-quote

[Katsumi Yamaoka]

>>>>> Kevin Ryde wrote:
> I attached a filename /tmp/" (a double-quote) and on sending it went out
> with file /tmp/\" (backslash and double-quote) attached instead.

> This was very bad as I had private information in that \" file!
> :-)

> I think mml-read-tag should apply a `read'.  I don't suppose anyone
> sends bizarrely named files, but it doesn't look hard to make it work.

It looks worth improving.  I've applied the patch to Gnus trunk
and Emacs trunk.  Thanks.