user/dev discussion of public-inbox itself
 help / Atom feed
* Stripping multipart/alternative HTML parts instead of rejecting
@ 2018-09-25 17:16 Konstantin Ryabitsev
  2018-09-26 19:47 ` Eric Wong
  0 siblings, 1 reply; 5+ messages in thread
From: Konstantin Ryabitsev @ 2018-09-25 17:16 UTC (permalink / raw)
  To: meta

[-- Attachment #1: Type: text/plain, Size: 421 bytes --]

Hi, all:

We've started adding other kernel-related mailing lists to 
lore.kernel.org, not all of them mailed via vger. This raised the issue 
of html-alternative parts, which are allowed by other mailing list 
providers that are using mailman. Such messages are currently rejected 
outright by public-inbox, but I'm wondering if that is perhaps too 
strict when there are plaintext parts available?

Best,
-K

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Stripping multipart/alternative HTML parts instead of rejecting
  2018-09-25 17:16 Stripping multipart/alternative HTML parts instead of rejecting Konstantin Ryabitsev
@ 2018-09-26 19:47 ` Eric Wong
  2018-09-26 20:57   ` Konstantin Ryabitsev
  0 siblings, 1 reply; 5+ messages in thread
From: Eric Wong @ 2018-09-26 19:47 UTC (permalink / raw)
  To: Konstantin Ryabitsev; +Cc: meta

Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
> Hi, all:
> 
> We've started adding other kernel-related mailing lists to lore.kernel.org,
> not all of them mailed via vger. This raised the issue of html-alternative
> parts, which are allowed by other mailing list providers that are using
> mailman. Such messages are currently rejected outright by public-inbox, but
> I'm wondering if that is perhaps too strict when there are plaintext parts
> available?

I tried scrubbing undesirable parts when the project started,
but it caused signature failures when replaying to mlmmj
subscribers, so I started rejecting those mails instead.

For pure mirrors, there is "filter = PublicInbox::Filter::Mirror"
which doesn't do any modifications at all:

[publicinbox "foo"]
        filter = PublicInbox::Filter::Mirror
	...

I mainly use it with -watch, but it should work with -mda (if
PublicInbox::Filter::Vger does).

But it should work better for NNTP readers who want to check
GPG and DKIM sigs on the original message with HTML.

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Stripping multipart/alternative HTML parts instead of rejecting
  2018-09-26 19:47 ` Eric Wong
@ 2018-09-26 20:57   ` Konstantin Ryabitsev
  2018-09-26 22:42     ` Eric Wong
  0 siblings, 1 reply; 5+ messages in thread
From: Konstantin Ryabitsev @ 2018-09-26 20:57 UTC (permalink / raw)
  To: Eric Wong; +Cc: meta

[-- Attachment #1: Type: text/plain, Size: 828 bytes --]

On Wed, Sep 26, 2018 at 07:47:05PM +0000, Eric Wong wrote:
>I tried scrubbing undesirable parts when the project started,
>but it caused signature failures when replaying to mlmmj
>subscribers, so I started rejecting those mails instead.
>
>For pure mirrors, there is "filter = PublicInbox::Filter::Mirror"
>which doesn't do any modifications at all:
>
>[publicinbox "foo"]
>        filter = PublicInbox::Filter::Mirror
>	...

Thanks, Eric, I'll poke at that.

>I mainly use it with -watch, but it should work with -mda (if
>PublicInbox::Filter::Vger does).
>
>But it should work better for NNTP readers who want to check
>GPG and DKIM sigs on the original message with HTML.

How do messages with a HTML part get displayed in the web view? Does it 
get offered as a download, or ignored completely?

-K

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Stripping multipart/alternative HTML parts instead of rejecting
  2018-09-26 20:57   ` Konstantin Ryabitsev
@ 2018-09-26 22:42     ` Eric Wong
  2018-09-27 16:08       ` Konstantin Ryabitsev
  0 siblings, 1 reply; 5+ messages in thread
From: Eric Wong @ 2018-09-26 22:42 UTC (permalink / raw)
  To: Konstantin Ryabitsev; +Cc: meta

Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
> How do messages with a HTML part get displayed in the web view? Does it get
> offered as a download, or ignored completely?

Offered as a text/plain so viewable and downloadable, but not rendered
by the browser as HTML (because of HTML/JS/CSS injection attacks)

Recent example here:
https://public-inbox.org/sox-users/5baaded3.1c69fb81.1ab9.5c49@mx.google.com/

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Stripping multipart/alternative HTML parts instead of rejecting
  2018-09-26 22:42     ` Eric Wong
@ 2018-09-27 16:08       ` Konstantin Ryabitsev
  0 siblings, 0 replies; 5+ messages in thread
From: Konstantin Ryabitsev @ 2018-09-27 16:08 UTC (permalink / raw)
  To: Eric Wong; +Cc: meta

On Wed, Sep 26, 2018 at 10:42:00PM +0000, Eric Wong wrote:
> Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
> > How do messages with a HTML part get displayed in the web view? Does it get
> > offered as a download, or ignored completely?
> 
> Offered as a text/plain so viewable and downloadable, but not rendered
> by the browser as HTML (because of HTML/JS/CSS injection attacks)
> 
> Recent example here:
> https://public-inbox.org/sox-users/5baaded3.1c69fb81.1ab9.5c49@mx.google.com/

This is what I was looking for, thanks!

-K

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-25 17:16 Stripping multipart/alternative HTML parts instead of rejecting Konstantin Ryabitsev
2018-09-26 19:47 ` Eric Wong
2018-09-26 20:57   ` Konstantin Ryabitsev
2018-09-26 22:42     ` Eric Wong
2018-09-27 16:08       ` Konstantin Ryabitsev

user/dev discussion of public-inbox itself

Archives are clonable:
	git clone --mirror https://public-inbox.org/meta
	git clone --mirror http://czquwvybam4bgbro.onion/meta
	git clone --mirror http://hjrcffqmbrq6wope.onion/meta
	git clone --mirror http://ou63pmih66umazou.onion/meta

Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.mail.public-inbox.meta
	nntp://ou63pmih66umazou.onion/inbox.comp.mail.public-inbox.meta
	nntp://czquwvybam4bgbro.onion/inbox.comp.mail.public-inbox.meta
	nntp://hjrcffqmbrq6wope.onion/inbox.comp.mail.public-inbox.meta
	nntp://news.gmane.org/gmane.mail.public-inbox.general

 note: .onion URLs require Tor: https://www.torproject.org/
       or Tor2web: https://www.tor2web.org/

AGPL code for this site: git clone https://public-inbox.org/ public-inbox