Subject: Re: Sieve notify options and escaping

From: "Aaron Stone" <[email-masked]>
Date: Mon, 26 Mar 2007 17:53:48 -0000

On Mon, Mar 26, 2007, Alexey Melnikov <[email-masked]> said:

> Aaron, Dave has forwarded me your message:

Ok, moving back on list since we're more than one side-comment out.

> Dave Cridland wrote:
> 
>> Dave,
>>
>>Barry and I discussed the need for some text to say what this means:
>>
>>    notify :options "body=${summary}" "mailto:foo@bar" 
>>
>>Because when you expand ${summary} is pretty important wrt escaping.
>>Barry said that he'd add some text to handle this. I forgot to mention
>>it in the jabber room for the official notes.
>>  
>>
> Is this specific to Mailto notification method? Note that there is no 
> text in notify base saying that options are to be converted to URI 
> parameters.

Same issues arise from this:  mailto "mailto:foo@bar?body=${summary}"

What if ${summary} expands to "safebody&evil=evilbody"? We'll need some
text to handle this situation I think. The issue applies to all
mechanisms, I'm sure we could just as easily have additional xmpp url
arguments or options.

Do we have the option for "lazy evaluation" of variable expansion? If the
expansion takes place inside the action, we have no trouble. If it takes
place prior to calling the action, we need escaping.

> Also, do we actually want to register the "body" option?

Sure, I don't see why not...

Aaron

---

From: Kjetil Torgrim Homme <[email-masked]>
Date: Tue, 27 Mar 2007 14:03:24 +0200

> place prior to calling the action, we need escaping.

[variables] says:

3.  Interpretation of strings
   [...]
   Tests or actions in future extensions may need to access the
   unexpanded version of the string argument and, e.g., do the expansion
   after setting variables in its namespace.  The design of the
   implementation should allow this.

so the door is kept open, but the extension needs to be explicit about
it.  notice that a separate namespace should be used for such "dynamic"
or "internal" variables, in other words it should be ${notify.summary},
not just ${summary}.  for normal variables without a namespace, the
behaviour is:

   The expanded string MUST use the variable values which are current
   when control reaches the statement the string is part of.

-- 
Kjetil T.

---

From: Aaron Stone <[email-masked]>
Date: Tue, 27 Mar 2007 07:14:14 -0700

>    when control reaches the statement the string is part of.

So a user can supply a variable that expands into valid options or url
syntax. I do think we have to prevent this.

Aaron