Don't replace text outside of PGP armor in looking glass

diracdeltas commented 9 years ago

Fix #34

diracdeltas commented 9 years ago

cc @adon-at-work for review.

adon-at-work commented 9 years ago

i lack an email to reproduce the described problem and verify the fix. but never mind, tried my best to review as much as i can. the code is of high quality, and it looks safe to merge. :)

diracdeltas commented 9 years ago

@adon-at-work To test, you can send yourself a email like:

this is an email header

-----BEGIN PGP MESSAGE----- 
Charset: UTF-8 
Version: Yahoo Mail End-To-End v0.0.5 

wf8AAAB+AzsR0bU37YgvEgIDBFT3UVHmWMkExQf7bNh35V04Yqbe8k20gXpt+wHF 
eU5LYxg+ZADK9xHJKxjsMl4ON0YMLmZvR2hcqs3qfkn98iUw9pIQsGUvED/S9pOA 
tqageNgPJSl+Vjmzpmzsow6HUd9Xy/fU7g2EKWHDRGS1IwKRwf8AAAB+AwSDtYBX 
9ZHuEgIDBCNyglLKnSC+A+4q5PVFMTStodGLI/vxwhe67zbfyExmYArdnhKTTSWE 
lXuFNkIHK2Cqmcndl8ePcpSkd+9CPmkwPAWXFR9DeFwfDP5wA4KqHS0Jagkhcdpo 
EaYgHu1tG6YxciiSPQc1cIDFRZC6uW0t0v8AAADbAU33fyv+XXv7ry3/YJ1G70j7 
4IVSTGnJ0woZCz9gD2SqiLgMp4M+pcymmrdMZnWIvDrjxqGB4S8oPQjoGwXiBWbZ 
le+1QuxD0wH6sA7Wymz3a2bM2IwExes/5onyvZTqcOS+fl6J/uoklxYNcNxfYNlI 
SdNs7EvbbFRYZPzCJG0k/DVEkCljIzdqsqnfKL7nUNNl2o9KVbi5Xv7e2zuVbofh 
utzwnBwKye/1HRgnnuOZxq0d84nQyBeIWpIpTmrR/slMS5h5jD85R0Yv+ZaSS059 
OcXVXZ+bjBvN 
=S/Jr 
-----END PGP MESSAGE----- 

this is an email footer

Before the patch, the expected result is that the entire email is replaced with the iframe, obscuring the header and footer text.

After the patch, only the PGP blob is replaced.

diracdeltas commented 9 years ago

how would eliminating the use of opt_text affect functions like the following? https://github.com/yahoo/end-to-end/blob/2492829f5788f40eee4f20864dffcec9ba0447f5/src/javascript/crypto/e2e/extension/helper/e2ebind.js#L581

opt_text still gets passed around as a function parameter. It is only used to set the original_text attribute which can be useful for debugging.

adon-at-work commented 9 years ago

I tested by sending myself an email like you said, but the fix didn't work as expected.

YahooArchive / end-to-end

Don't replace text outside of PGP armor in looking glass #49