Re: Hook in external programs

Marco writes:

> Hi,
>
> I'm new to maildrop and need some advice on how to set it up. I
> don't do anything fancy, just a few filters to sort mail into
> folders.
>
> For important mails I'd like to have a notification. What is the
> best way to hook in an external program like notify-send? Here is an
> example of what I'd like to do:
>
> if (/^List-ID: .*(alpha\.lists\.sourceforge\.net)/:h)
> to "$MAILHOME/.Lists.alpha"
> # notify-send 'New mail! List: alpha' 'From: **From**'
>
> if (/^List-ID: .*(beta\.lists\.sourceforge\.net)/:h)
> to "$MAILHOME/.Lists.beta"
> # notify-send 'New mail! List: beta' 'From: **From**'
>
> The external program notify-send should be invoked before or after
> the mail is placed in the corresponding folder including information
> about who sent the mail.
>
> How do I hook notify-send into the filters?
> How do I access the From: header to be provided as argument to
> notify-send?

There are a number of ways to invoke an external program. The cc command,  
for example, can run an external program and pipe it the entire message on  
standard input. Alternatively, the backticks also execute an external  
program, but without piping the message to it. If the result of the  
backticks expression is not assigned anywhere, the output of the external  
program gets basically thrown away.

Using regular expressions and pattern matching you can extract various bits  
of pieces from the headers, put them into variables, and pass them to an  
external program.

However, before doing so, it is necessary to fully understanding exactly how  
the process works. Since the shell gets used to execute an external program,  
and the various bits and pieces you're extracting from a message come from  
untrusted sources, until there is full and complete understanding of shell  
quoting rules, it's quite easy to create an exploitable situation that a  
hostile attacker can take advantage of.

Let's say, for example, you intend to extract the subject line of the  
message, put it in $SUBJECT, and pass it as a parameter to your external  
program. The naive approach would be something like this, in .maildropfilter:

`notify-send -s "$SUBJECT"`

Well, guess what happens if someone sends you the following message:

Subject: "; rm -rf $HOME # You're 0wned!

So, for doing this kind of an automated mail processing, you really need to  
have a pretty good grasp of information security.

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Courier-maildrop mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/courier-maildrop

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iEYEABECAAYFAlD/QW0ACgkQx9p3GYHlUOLsOACffdtdCS6b0dzGtpXbTuYMlnv2
6sAAniONb7ttCg6Acm6X1Uw5ztzqDckQ
=MDDR
-----END PGP SIGNATURE-----