diff options
| author | Miles Bader <miles@gnu.org> | 2006-11-20 02:43:10 +0000 |
|---|---|---|
| committer | Miles Bader <miles@gnu.org> | 2006-11-20 02:43:10 +0000 |
| commit | b07e014310fd5536f85ffff82ec87ccacd2992ba (patch) | |
| tree | 93b29c65ee2665e2c757fc9db2afd6df12db4144 /lisp/gnus/mm-uu.el | |
| parent | b98f7445751fdaf08c83d47542d756812a1efcd2 (diff) | |
| download | emacs-b07e014310fd5536f85ffff82ec87ccacd2992ba.tar.gz | |
Merge from gnus--rel--5.10
Patches applied:
* gnus--rel--5.10 (patch 167)
- Update from CVS
2006-11-18 Andreas Seltenreich <uwi7@rz.uni-karlsruhe.de>
* lisp/gnus/mm-uu.el (mm-uu-pgp-signed-extract-1): Make last fix more thorough
and comment it.
* lisp/gnus/nnslashdot.el (nnslashdot-retrieve-headers-1): Update regexp.
Revision: emacs@sv.gnu.org/emacs--devo--0--patch-518
Diffstat (limited to 'lisp/gnus/mm-uu.el')
| -rw-r--r-- | lisp/gnus/mm-uu.el | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/lisp/gnus/mm-uu.el b/lisp/gnus/mm-uu.el index b1ed0b7af4e..311dce0d1b2 100644 --- a/lisp/gnus/mm-uu.el +++ b/lisp/gnus/mm-uu.el @@ -373,8 +373,16 @@ Return that buffer." mm-security-handle 'gnus-details (format "Clear verification not supported by `%s'.\n" mml2015-use)))) (goto-char (point-min)) - (if (re-search-forward "\n[\t ]*\n" nil t) - (delete-region (point-min) (point))) + (forward-line) + ;; We need to be careful not to strip beyond the armor headers. + ;; Previously, an attacker could replace the text inside our + ;; markup with trailing garbage by injecting whitespace into the + ;; message. + (while (looking-at "Hash:") ; The only header allowed in cleartext + (forward-line)) ; signatures according to RFC2440. + (when (looking-at "[\t ]*$") + (forward-line)) + (delete-region (point-min) (point)) (if (re-search-forward mm-uu-pgp-beginning-signature nil t) (delete-region (match-beginning 0) (point-max))) (goto-char (point-min)) |