From f8c8ca04d47620d390092000ca09aab071442fac Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Tue, 4 Jun 2019 02:04:27 +0000 Subject: wwwattach: only pass the charset through if ASCII AFAIK all names of charsets are ASCII, so passing non-ASCII characters from emails to clients would probably confuse clients. --- lib/PublicInbox/WwwAttach.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/PublicInbox/WwwAttach.pm b/lib/PublicInbox/WwwAttach.pm index d690ce41..96103cb0 100644 --- a/lib/PublicInbox/WwwAttach.pm +++ b/lib/PublicInbox/WwwAttach.pm @@ -27,7 +27,7 @@ sub get_attach ($$$) { if ($ct && (($ct->{discrete} || '') eq 'text')) { # display all text as text/plain: my $cset = $ct->{attributes}->{charset}; - if ($cset && ($cset =~ /\A[\w-]+\z/)) { + if ($cset && ($cset =~ /\A[a-zA-Z0-9_\-]+\z/)) { $res->[1]->[1] .= qq(; charset=$cset); } } else { # TODO: allow user to configure safe types -- cgit v1.2.3-24-ge0c7