diff --git a/CVE-2015-20107-mailcap-unsafe-filenames.patch b/CVE-2015-20107-mailcap-unsafe-filenames.patch index 1c600d5..cee0580 100644 --- a/CVE-2015-20107-mailcap-unsafe-filenames.patch +++ b/CVE-2015-20107-mailcap-unsafe-filenames.patch @@ -45,17 +45,17 @@ # Part 1: top-level interface. def getcaps(): -@@ -16,6 +24,10 @@ def getcaps(): - where the viewing command is stored with the key "view". - +@@ -18,6 +26,10 @@ def getcaps(): """ -+ if _find_unsafe(filename): -+ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (filename,) -+ warnings.warn(msg, UnsafeMailcapInput) -+ return None, None caps = {} for mailcap in listmailcapfiles(): ++ if _find_unsafe(mailcap): ++ msg = "Refusing to use mailcap with filename %r. Use a safe temporary filename." % (mailcap,) ++ warnings.warn(msg, UnsafeMailcapInput) ++ return None, None try: + fp = open(mailcap, 'r') + except IOError: @@ -149,10 +161,13 @@ def findmatch(caps, MIMEtype, key='view' for e in entries: if 'test' in e: