pgnus-0.33: multipart/mixed: usage of filename?

pgnus-0.33: multipart/mixed: usage of filename?

[Kai Grossjohann]

Hi all,

our fax software sends me multipart/mixed messages where each fax page
is a part, with headers like so:

,-----
| Content-Type: image/g3n
| Content-Disposition: inline; filename="/var/spool/fax/incoming/fn608ec94ya-_-+49-231-7552130_.01"
| Content-Transfer-Encoding: base64
`-----

After this header comes the fax itself, base64-encoded.  When wanting
to view this file, Emacs tells me:

,-----
| Opening output file: no such file or directory, /var/spool/fax/incoming/fn608ec94ya-_-+49-231-7552130_.01 [2 times]
`-----

It seems that Gnus tries to write into that file, but as the directory
doesn't exist (it's a directory name from our fax server), that's
bound to fail.

Shouldn't Gnus write the file in /tmp as usual, disregarding the
filename, when *viewing* such stuff?  I'd be happy with Gnus using the
filename as default when *saving* the stuff, but why is it used at all
for viewing?

kai
-- 
OOP: object oriented programming;  OOPS: object oriented mistakes

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Kai Grossjohann]

>>>>> On 25 Sep 1998, Kai Grossjohann said:

  KG> ,-----
  KG> | Opening output file: no such file or directory, /var/spool/fax/incoming/fn608ec94ya-_-+49-231-7552130_.01 [2 times]
  KG> `-----

FWIW, I edited the message, removing the `filename=' part, and voilà,
g3view was called on a file /tmp/emm*/*/*, like expected.

kai
-- 
OOP: object oriented programming;  OOPS: object oriented mistakes

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Robert Bihlmeyer]

Hi,

>>>>> On 25 Sep 1998 11:29:59 +0200
>>>>> Kai Grossjohann <grossjohann@amaunet.cs.uni-dortmund.de> said:

 Kai> Shouldn't Gnus write the file in /tmp as usual, disregarding the
 Kai> filename, when *viewing* such stuff? I'd be happy with Gnus
 Kai> using the filename as default when *saving* the stuff, but why
 Kai> is it used at all for viewing?

Hehe, I'll send root an /etc/passwd, base64'd. She uses pgnus, views it, 
voila!

	Robbe

-- 
Robert Bihlmeyer	reads: Deutsch, English, MIME, Latin-1, NO SPAM!
<robbe@orcus.priv.at>	<http://stud2.tuwien.ac.at/~e9426626/sig.html>

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Kai Grossjohann <grossjohann@amaunet.cs.uni-dortmund.de> writes:

> It seems that Gnus tries to write into that file, but as the directory
> doesn't exist (it's a directory name from our fax server), that's
> bound to fail.

Yup.  I made it do this because I thought that perhaps some external
viewers looked at parts of the name to determine whether it could
display it or not.

Slashes will have to be translated, though.

Or should I just go back to autogenerated names?  Hm?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Jan Vroonhof]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Yup.  I made it do this because I thought that perhaps some external
> viewers looked at parts of the name to determine whether it could
> display it or not.

Just use ONLY the base name in a auto generated tempdir, like gnus-uu
does.

Jan

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Jan Vroonhof <vroonhof@math.ethz.ch> writes:

> > Yup.  I made it do this because I thought that perhaps some external
> > viewers looked at parts of the name to determine whether it could
> > display it or not.
> 
> Just use ONLY the base name in a auto generated tempdir, like gnus-uu
> does.

You mean only the suffix?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Jan Vroonhof]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> > Just use ONLY the base name in a auto generated tempdir, like gnus-uu
> > does.
> 
> You mean only the suffix?

Thats probably even better.

Jan

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Jan Vroonhof <vroonhof@math.ethz.ch> writes:

> > > Just use ONLY the base name in a auto generated tempdir, like gnus-uu
> > > does.
> > 
> > You mean only the suffix?
> 
> Thats probably even better.

Doing so would make sense, but if the file name characters are
properly translated and quoted, wouldn't it be nice to have the full
real names of the files available in the external viewer?  

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Edward J. Sabol]

Excerpts from mail: (01-Oct-98) Re: pgnus-0.33: multipart/mixed: usage of filename? by Lars Magne Ingebrigtsen
> Jan Vroonhof <vroonhof@math.ethz.ch> writes:
>>>> Just use ONLY the base name in a auto generated tempdir, like gnus-uu
>>>> does.
>>> 
>>> You mean only the suffix?
>> 
>> Thats probably even better.
>
> Doing so would make sense, but if the file name characters are
> properly translated and quoted, wouldn't it be nice to have the full
> real names of the files available in the external viewer?  

I would much rather have the real file name! I think that if you get an
e-mail with a MIME object whose name is "/foo/bar/blah/whatever", then Gnus
should save the file as "whatever" in a directory that you specify in a
configuration variable. I.e., parse out the filename and override any
directory specification in the name. This way if someone sends root a
text/plain MIME object with Content-Disposition set to attachment and name
set to "/etc/passwd", the won't get saved in /etc/passwd, but will instead be
saved in /tmp/passwd (or whereever you have your gnus-mime-save-directory
configuration variable set to).

Later,
Ed

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

"Edward J. Sabol" <sabol@alderaan.gsfc.nasa.gov> writes:

> I would much rather have the real file name! I think that if you get an
> e-mail with a MIME object whose name is "/foo/bar/blah/whatever", then Gnus
> should save the file as "whatever" in a directory that you specify in a
> configuration variable. 

Yup.  Fix in Pterodactyl Gnus v0.34.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[grossjohann]

>>>>> Excerpts from mail: (01-Oct-98) Re: pgnus-0.33: multipart/mixed: usage of filename? by Lars Magne Ingebrigtsen

  Lars> Doing so would make sense, but if the file name characters are
  Lars> properly translated and quoted, wouldn't it be nice to have
  Lars> the full real names of the files available in the external
  Lars> viewer?

>>>>> On Thu, 1 Oct 1998, Edward J Sabol said:

  EJS> I would much rather have the real file name!

Well, rather than saving /etc/passwd in /tmp/emmXYZZY/passwd, saving
/etc/passwd in /tmp/emmXYZZY/%etc%passwd would also be a possibility.
Which is what Lars is suggesting, I think.  There's no security risk
and you get the absolute pathname information.

kai
-- 
OOP: object oriented programming;  OOPS: object oriented mistakes

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Simon Josefsson]

grossjohann@amaunet.cs.uni-dortmund.de writes:

>   Lars> Doing so would make sense, but if the file name characters are
>   Lars> properly translated and quoted, wouldn't it be nice to have
>   Lars> the full real names of the files available in the external
>   Lars> viewer?
> 
> >>>>> On Thu, 1 Oct 1998, Edward J Sabol said:
> 
>   EJS> I would much rather have the real file name!
> 
> Well, rather than saving /etc/passwd in /tmp/emmXYZZY/passwd, saving
> /etc/passwd in /tmp/emmXYZZY/%etc%passwd would also be a possibility.
> Which is what Lars is suggesting, I think.  There's no security risk
> and you get the absolute pathname information.

Actually then I get a useless garbage version of the pathname. :-)
What if the filename contains %'s?

If Gnus has to encode the filename, let's go for a something that's
standard (UTF-7?) at least.

I'd prefer Gnus to save it as /tmp/emmXYZZY/etc/passwd instead (of
course removing all "../" in the filename for security), then I could
"cp -r /tmp/emmXYZZY/* /" if I wanted to.

/s

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Simon Josefsson <jas@pdc.kth.se> writes:

> I'd prefer Gnus to save it as /tmp/emmXYZZY/etc/passwd instead (of
> course removing all "../" in the filename for security), then I could
> "cp -r /tmp/emmXYZZY/* /" if I wanted to.

Uhm...  No, I don't think that would be of much actual use -- I can't
imagine someone ever doing that.  Well, if we had a save-all-parts
command, it might be more realistic, actually.  Hm.  Er.  Hm.  Does
anyone ever send a multipart/mixed message that contains an entire
directory hierarchy?

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Jan Vroonhof]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Doing so would make sense, but if the file name characters are
> properly translated and quoted, wouldn't it be nice to have the full
> real names of the files available in the external viewer?  

Yes, but without the path! (I think that was what the original 
complaint was). Thats what I suggested. You put a file with file name
/etc/passwd in /tmp/mblabla/passwd then call the viewer.

Jan

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Jan Vroonhof <vroonhof@math.ethz.ch> writes:

> > Doing so would make sense, but if the file name characters are
> > properly translated and quoted, wouldn't it be nice to have the full
> > real names of the files available in the external viewer?  
> 
> Yes, but without the path!

Yup.  

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Kai Grossjohann]

I imagine it would be nice to have some directory components available
for certain files.  Such as emacs-20.3/lib-src/Makefile.  Hm.  No
general solution is available, though, so maybe we should just rely on
the user to remember the real meaning of a file from the [...] button
in the original message?
kai
-- 
OOP: object oriented programming;  OOPS: object oriented mistakes

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Kai Grossjohann <Kai.Grossjohann@CS.Uni-Dortmund.DE> writes:

> I imagine it would be nice to have some directory components available
> for certain files.  Such as emacs-20.3/lib-src/Makefile.  Hm.  No
> general solution is available, though, so maybe we should just rely on
> the user to remember the real meaning of a file from the [...] button
> in the original message?

I'm leaning towards that solution.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Jan Vroonhof]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> > I imagine it would be nice to have some directory components available
> > for certain files.  Such as emacs-20.3/lib-src/Makefile.  Hm.  No
> > general solution is available, though, so maybe we should just rely on
> > the user to remember the real meaning of a file from the [...] button
> > in the original message?
> 
> I'm leaning towards that solution.

But you only need the full path when "extracting" and then you just
get the full-path as a default prompt or not?

Jan

Re: pgnus-0.33: multipart/mixed: usage of filename?

[Lars Magne Ingebrigtsen]

Jan Vroonhof <vroonhof@math.ethz.ch> writes:

> But you only need the full path when "extracting" and then you just
> get the full-path as a default prompt or not?

No, when saving parts you default to the current directory and the
leaf of the file name.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen