Check filenames for --save-* for forbidden characters

[mimedecode.git] / mimedecode.py

diff --git a/mimedecode.py b/mimedecode.py
index 1e3bf74b3964717de33883c8b160c19db805f664..da63350485e7981713b88257bbccc12bb711efd2 100755 (executable)
--- a/mimedecode.py
+++ b/mimedecode.py
@@ -34,12 +34,9 @@ def output_headers(msg):
     output("\n") # End of headers
 
 
-def recode(s, charset):
-    return unicode(s, charset, "replace").encode(g.default_encoding, "replace")
-
 def recode_if_needed(s, charset):
     if charset and charset.lower() <> g.default_encoding:
-        s = recode(s, charset)
+        s = unicode(s, charset, "replace").encode(g.default_encoding, "replace")
     return s
 
 
@@ -77,9 +74,6 @@ def decode_header(msg, header):
             set_header(msg, header, new_value)
 
 
-def _decode_header_param(s):
-    return recode_if_needed(s[2], s[0])
-
 def decode_header_param(msg, header, param):
     "Decode mail header's parameter (if exists) and put it back, if it was encoded"
 
@@ -87,7 +81,7 @@ def decode_header_param(msg, header, param):
         value = msg.get_param(param, header=header)
         if value:
             if isinstance(value, tuple):
-                new_value = _decode_header_param(value)
+                new_value = recode_if_needed(value[2], value[0])
             else:
                 new_value = _decode_header(value)
             if new_value <> value: # do not bother to touch msg if not changed
@@ -276,6 +270,12 @@ def _save_message(msg, outstring, save_headers=False, save_body=False):
     ):
         fname = msg.get_param(param, header=header)
         if fname:
+            try:
+                    for forbidden in chr(0), '/', '\\':
+                        if forbidden in fname:
+                            raise ValueError
+            except ValueError:
+                continue
             fname = '-' + fname
             break
     else:
@@ -285,7 +285,7 @@ def _save_message(msg, outstring, save_headers=False, save_body=False):
 
     global output
     save_output = output
-    outfile = open(os.path.join(g.destination_dir, fname), 'w')
+    outfile = open_output_file(fname)
     output = outfile.write
     if save_headers:
         output_headers(msg)
@@ -341,7 +341,7 @@ def decode_part(msg):
             output("\nMessage body of type %s skipped.\n" % ctype)
             break
         elif content_type in g.error_mask:
-            raise ValueError, "content type %s prohibited" % ctype
+            break
     else:
         # Neither content type nor masks were listed - decode by default
         outstring = totext(msg, outstring)
@@ -354,6 +354,10 @@ def decode_part(msg):
         elif content_type in g.save_message_mask:
             _save_message(msg, outstring, save_headers=True, save_body=True)
 
+    for content_type in masks:
+        if content_type in g.error_mask:
+            raise ValueError, "content type %s prohibited" % ctype
+
 def decode_multipart(msg):
     "Decode multipart"
 
@@ -397,6 +401,19 @@ def decode_message(msg):
         output(msg.as_string())
 
 
+def open_output_file(filename):
+    fullpath = os.path.abspath(os.path.join(g.destination_dir, filename))
+    full_dir = os.path.dirname(fullpath)
+    create = not os.path.isdir(full_dir)
+    if create:
+        os.makedirs(full_dir)
+    try:
+        return open(fullpath, 'w')
+    except:
+        if create:
+            os.removedirs(full_dir)
+
+
 class GlobalOptions:
     from m_lib.defenc import default_encoding
     recode_charset = 1 # recode charset of message body
@@ -523,7 +540,7 @@ if __name__ == "__main__":
         g.input_filename = '-'
         infile = sys.stdin
         if g.output_filename:
-            outfile = open(os.path.join(g.destination_dir, g.output_filename), 'w')
+            outfile = open_output_file(g.output_filename)
         else:
             g.output_filename = '-'
             outfile = sys.stdout
@@ -536,7 +553,7 @@ if __name__ == "__main__":
             infile = open(arguments[0], 'r')
         if la == 1:
             if g.output_filename:
-                outfile = open(os.path.join(g.destination_dir, g.output_filename), 'w')
+                outfile = open_output_file(g.output_filename)
             else:
                 g.output_filename = '-'
                 outfile = sys.stdout
@@ -548,7 +565,7 @@ if __name__ == "__main__":
                 outfile = sys.stdout
             else:
                 g.output_filename = arguments[1]
-                outfile = open(os.path.join(g.destination_dir, g.output_filename), 'w')
+                outfile = open_output_file(g.output_filename)
     else:
         usage(1, 'Too many arguments')
 
@@ -567,7 +584,7 @@ if __name__ == "__main__":
     msg = email.message_from_file(infile)
 
     for header, value in g.set_header_value:
-        msg[header] = value
+        set_header(msg, header, value)
 
     for header, param, value in g.set_header_param:
         if header in msg: