procmail
[Top] [All Lists]

Wishlist for Procmail v4 (was: [MSIE security exploit thread])

1998-07-30 01:04:37
On Wed, 29 Jul 1998 15:53:25 -0600, Geoff Mulligan
<geoff(_at_)mulligan(_dot_)com> wrote:
possible to overrun other mime fields. I think that the best way to
fix this is to check the header to see if it is a mime message and
then run the message through a true mime interpreter that would

What I'd like to see in Procmail v4 would be something to allow one to
do simple operations on all the accumulated values of various fields,
including MIME support. Perhaps this could look something like

    # Note: purely speculative syntax I just made up
    :0mh  # Note: purely speculative MIME header match flag
    * ::Content-Disposition::filename ?? "[^"]\{64\}
    purely-speculative-action

This would mean, in the "filename" subfield of the
"Content-Disposition" field in RFC822 headers and MIME body part
headers, look for a double-quote followed by 64 non-double-quotes.

The support for subfields could be extended to cover the tricky email
terminus part (and of course, orthogonally, real name and/or comments)
of email address fields:

    :0   # Note: another purely speculative syntax example
    *  1^1 ::To::terminus            ?? .*
    *  1^1 ::Cc::terminus            ?? .*
    *  1^1 ::Apparently-To::terminus ?? .*
    * -5^0
    too-many-speculated-recipients

This would mean, in the actual email terminus part of the To, Cc, and
Apparently-To fields, score one for each.

And while you're at it, why not add in some kind of support for the
various subfields of Received: headers:

    :0  # Note: I'm still speculating
    * ::Received::by   ?? .*wwa\.com^^
    * ::Received::time ?? ^^\/.*
    { ... }

The above would of course not really be the proper way to fetch the
::Received::time field out of a Received: line whose ::Received::by
matched wwa.com. There would need to be a separate mechanism for that,
too:

    # Not very elegant -- how could this be done neater?
    :0  # Note: I'm not done speculating yet
    * ::Received ?? (::by::.*wwa\.com^^)(::time::\/.*)
    { ... }

Even given this, it's hard to say, see if there is a broken link in
the "Received: from -- Received: by" chain, or to find, say, the
Received: from of the nth line and compare to any of the other
Received: from lines, successively for all n. Generally speaking,
there really should be a way to pair an arbitrary couple of lines and
see if they match, but I'll stop chanting now. Comments?

/* era */

-- 
 Paparazzi of the Net: No matter what you do to protect your privacy,
  they'll hunt you down and spam you. <http://www.iki.fi/~era/spam/>