From 47629e9e87a324531be881cebfca38dd38f8afaa Mon Sep 17 00:00:00 2001
From: David Levine <levinedl@acm.org>
Date: Wed, 17 Jan 2018 19:36:12 -0500
Subject: [PATCH] Wrapped uses of %{charset} in mhn.defaults with double
 quotes.

---
 NEWS                         |  1 +
 etc/mhn.defaults.sh          | 14 +++++++-------
 man/mhshow.man               |  6 +++---
 test/mhshow/test-textcharset | 17 +++++++++++++++++
 4 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/NEWS b/NEWS
index b4598873..ef15c711 100644
--- a/NEWS
+++ b/NEWS
@@ -129,6 +129,7 @@ BUG FIXES
 - An error when writing an error message, e.g. EPIPE, no longer causes
   recursion until the stack is exhausted.
 - rcvdist(1) now passes switch arguments to post(8).
+- The uses of %{charset} in mhn.defaults were wrapped with double quotes.
 
 -------------------
 DEPRECATED FEATURES
diff --git a/etc/mhn.defaults.sh b/etc/mhn.defaults.sh
index 0253f283..5566f215 100755
--- a/etc/mhn.defaults.sh
+++ b/etc/mhn.defaults.sh
@@ -131,7 +131,7 @@ fi
 ####
 cat <<EOF >>${TMP}
 mhbuild-convert-text/calendar: mhical -infile %F -contenttype
-mhbuild-convert-text: charset=%{charset}; iconv -f \${charset:-us-ascii} -t utf-8 %F${replfmt}
+mhbuild-convert-text: charset="%{charset}"; iconv -f "\${charset:-us-ascii}" -t utf-8 %F${replfmt}
 mhbuild-disposition-text/calendar: inline
 mhbuild-disposition-message/rfc822: inline
 EOF
@@ -287,24 +287,24 @@ EOF
 # that another netscape is already running and certain things can't be done).
 PGM=`$SEARCHPROG "$SEARCHPATH" w3m`
 if [ ! -z "$PGM" ]; then
-    echo 'mhshow-show-text/html: charset=%{charset}; '"\
+    echo 'mhshow-show-text/html: charset="%{charset}"; '"\
 %l$PGM"' -dump ${charset:+-I} ${charset:+"$charset"} -T text/html %F' >> $TMP
-    echo 'mhfixmsg-format-text/html: charset=%{charset}; '"\
+    echo 'mhfixmsg-format-text/html: charset="%{charset}"; '"\
 $PGM "'-dump ${charset:+-I} ${charset:+"$charset"} -O utf-8 -T text/html %F' \
          >> $TMP
-    echo 'mhbuild-convert-text/html: charset=%{charset}; '"\
+    echo 'mhbuild-convert-text/html: charset="%{charset}"; '"\
 $PGM "'-dump ${charset:+-I} ${charset:+"$charset"} -O utf-8 -T text/html %F '"\
 ${replfmt}" >> $TMP
 else
     PGM=`$SEARCHPROG "$SEARCHPATH" lynx`
     if [ ! -z "$PGM" ]; then
-	echo 'mhshow-show-text/html: charset=%{charset}; '"\
+	echo 'mhshow-show-text/html: charset="%{charset}"; '"\
 %l$PGM"' -child -dump -force-html ${charset:+--assume_charset} ${charset:+"$charset"} %F' >> $TMP
         #### lynx indents with 3 spaces, remove them and any trailing spaces.
-        echo 'mhfixmsg-format-text/html: charset=%{charset}; '"\
+        echo 'mhfixmsg-format-text/html: charset="%{charset}"; '"\
 $PGM "'-child -dump -force_html ${charset:+--assume_charset} ${charset:+"$charset"} %F | '"\
 expand | sed -e 's/^   //' -e 's/  *$//'" >> $TMP
-        echo 'mhbuild-convert-text/html: charset=%{charset}; '"\
+        echo 'mhbuild-convert-text/html: charset="%{charset}"; '"\
 $PGM "'-child -dump -force_html ${charset:+--assume_charset} ${charset:+"$charset"} '"\
 %F${replfmt}" >> $TMP
     else
diff --git a/man/mhshow.man b/man/mhshow.man
index 935e1d17..4cbbd191 100644
--- a/man/mhshow.man
+++ b/man/mhshow.man
@@ -360,14 +360,14 @@ for the current display string to finish execution before executing
 the next display string.
 .PP
 The {parameter} escape is typically used in a command line argument
-that should only be present if it has a non-null value.  Its value
-will be wrapped with single quotes if the escape is not so wrapped.
+that should only be present if it has a non-null value.  It is highly
+recommended that the entire escape be wrapped in double quotes.
 Shell parameter expansion can construct the argument only when it is
 non-null, e.g.,
 .PP
 .RS 5
 .nf
-mhshow-show-text/html: charset=%{charset};
+mhshow-show-text/html: charset="%{charset}";
   w3m ${charset:+-I $charset} -T text/html %F
 .fi
 .RE
diff --git a/test/mhshow/test-textcharset b/test/mhshow/test-textcharset
index 8bba1695..78500a5d 100755
--- a/test/mhshow/test-textcharset
+++ b/test/mhshow/test-textcharset
@@ -305,6 +305,23 @@ EOF
 run_prog mhshow last >"$actual" 2>&1
 check "$expected" "$actual" : parameter value quoting with text following
 
+# check malicious parameter value quoting
+msgfile=`mhpath new`
+msgnum=`basename $msgfile`
+cat >"$msgfile" <<'EOF'
+Subject: shows difficulty of quoting with /bin/sh -c
+MIME-Version: 1.0
+Content-Type: text/html; charset="oops'; echo should not see this!"
+
+EOF
+
+cat >"$expected" <<EOF
+[ part  - text/html -   0B  ]
+EOF
+
+run_prog mhshow -noheader -form mhl.null last >"$actual" 2>&1
+check "$expected" "$actual" : malicious parameter value quoting
+
 #
 # test a large file that needs to be converted to UTF-8
 #
-- 
2.56.0