webmail: recognize q/b-word-encoded filenames in attachments in messages

according to the rfc's (2231, and 2047), non-ascii filenames in content-type
and content-disposition headers should be encoded like this:

	Content-Type: text/plain; name*=utf-8''hi%E2%98%BA.txt
	Content-Disposition: attachment; filename*=utf-8''hi%E2%98%BA.txt

and that is what the Go standard library mime.ParseMediaType and
mime.FormatMediaType parse and generate.

this is what thunderbird sends:

	Content-Type: text/plain; charset=UTF-8; name="=?UTF-8?B?aGnimLoudHh0?="
	Content-Disposition: attachment; filename*=UTF-8''%68%69%E2%98%BA%2E%74%78%74

(thunderbird will also correctly split long filenames over multiple parameters,
named "filename*0*", "filename*1*", etc.)

this is what gmail sends:

	Content-Type: text/plain; charset="US-ASCII"; name="=?UTF-8?B?aGnimLoudHh0?="
	Content-Disposition: attachment; filename="=?UTF-8?B?aGnimLoudHh0?="

i cannot find where the q/b-word encoded values in "name" and "filename" are
allowed. until that time, we try parsing them unless in pedantic mode.

we didn't generate correctly encoded filenames yet, this commit also fixes that.

for issue #82 by mattfbacon, thanks for reporting!
This commit is contained in:
Mechiel Lukkien
2023-10-14 14:14:13 +02:00
parent 3e53343d21
commit a40f5a5eb3
4 changed files with 74 additions and 45 deletions

View File

@ -524,9 +524,11 @@ func (w Webmail) MessageSubmit(ctx context.Context, m SubmitMessage) {
header("Content-Type", fmt.Sprintf(`multipart/mixed; boundary="%s"`, mp.Boundary()))
line(xmsgw)
ct := mime.FormatMediaType("text/plain", map[string]string{"charset": charset})
textHdr := textproto.MIMEHeader{}
textHdr.Set("Content-Type", "text/plain; charset="+escapeParam(charset))
textHdr.Set("Content-Type", ct)
textHdr.Set("Content-Transfer-Encoding", cte)
textp, err := mp.CreatePart(textHdr)
xcheckf(ctx, err, "adding text part to message")
_, err = textp.Write([]byte(text))
@ -534,13 +536,11 @@ func (w Webmail) MessageSubmit(ctx context.Context, m SubmitMessage) {
xaddPart := func(ct, filename string) io.Writer {
ahdr := textproto.MIMEHeader{}
if ct == "" {
ct = "application/octet-stream"
}
ct += fmt.Sprintf(`; name="%s"`, filename)
cd := mime.FormatMediaType("attachment", map[string]string{"filename": filename})
ahdr.Set("Content-Type", ct)
ahdr.Set("Content-Transfer-Encoding", "base64")
ahdr.Set("Content-Disposition", fmt.Sprintf(`attachment; filename=%s`, escapeParam(filename)))
ahdr.Set("Content-Disposition", cd)
ap, err := mp.CreatePart(ahdr)
xcheckf(ctx, err, "adding attachment part to message")
return ap
@ -587,12 +587,21 @@ func (w Webmail) MessageSubmit(ctx context.Context, m SubmitMessage) {
}
ct := strings.TrimSuffix(t[0], "base64")
ct = strings.TrimSuffix(ct, ";")
if ct == "" {
ct = "application/octet-stream"
}
filename := a.Filename
if filename == "" {
filename = "unnamed.bin"
}
params := map[string]string{"name": filename}
ct = mime.FormatMediaType(ct, params)
// Ensure base64 is valid, then we'll write the original string.
_, err := io.Copy(io.Discard, base64.NewDecoder(base64.StdEncoding, strings.NewReader(t[1])))
xcheckuserf(ctx, err, "parsing attachment as base64")
xaddAttachmentBase64(ct, a.Filename, []byte(t[1]))
xaddAttachmentBase64(ct, filename, []byte(t[1]))
}
if len(m.ForwardAttachments.Paths) > 0 {
@ -617,14 +626,16 @@ func (w Webmail) MessageSubmit(ctx context.Context, m SubmitMessage) {
ap = ap.Parts[xp]
}
filename := ap.ContentTypeParams["name"]
filename := tryDecodeParam(log, ap.ContentTypeParams["name"])
if filename == "" {
filename = "unnamed.bin"
}
ct := strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)
params := map[string]string{"name": filename}
if pcharset := ap.ContentTypeParams["charset"]; pcharset != "" {
ct += "; charset=" + escapeParam(pcharset)
params["charset"] = pcharset
}
ct := strings.ToLower(ap.MediaType + "/" + ap.MediaSubType)
ct = mime.FormatMediaType(ct, params)
xaddAttachment(ct, filename, ap.Reader())
}
})
@ -634,7 +645,8 @@ func (w Webmail) MessageSubmit(ctx context.Context, m SubmitMessage) {
err = mp.Close()
xcheckf(ctx, err, "writing mime multipart")
} else {
header("Content-Type", "text/plain; charset="+escapeParam(charset))
ct := mime.FormatMediaType("text/plain", map[string]string{"charset": charset})
header("Content-Type", ct)
header("Content-Transfer-Encoding", cte)
line(xmsgw)
xmsgw.Write([]byte(text))