path traversal fix, license, update to 0.2.7

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Iris Lightshard <nilix@nilfm.cc>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

taro-ctl.cr

@@ -234,10 +234,18 @@ module Taro
     end
     
     def refile_mail(range_start : UInt16, range_end : UInt16, to_mbox : String)
-      to_mbox = to_mbox.gsub("'", "\'").gsub("../", "./").gsub("..", "")
+      canonical_mbox = run_cmd("readlink -f '#{MBOX_ROOT}/#{to_mbox.gsub("'", "\'")}'").to_s
-      cmd = "mrefile #{range_start}:#{range_end} '#{MBOX_ROOT}/#{to_mbox}'"
+      
+      # if readlink is not available, fall back to what the user gave :shrug:
+      if canonical_mbox.empty?
+        canonical_mbox = "#{MBOX_ROOT}/#{to_mbox}"
+      end
+      
+      if canonical_mbox.starts_with?(MBOX_ROOT)
+        cmd = "mrefile #{range_start}:#{range_end} #{canonical_mbox.gsub(" ", "\ ").gsub("\"", "\\\"").gsub("'", "\'")}"
         run_cmd(cmd)
       end
+    end
     
     def search_mail(query : String, body : Bool, case_sensitive : Bool) : IO::Memory
       query = query.gsub("'", "\'")

taro-ls.tal

@@ -85,7 +85,7 @@
   load_font
 
   #0280 .Screen/width DEO2
-  #01c0 .Screen/height DEO2
+  #0100 .Screen/height DEO2
   
   ;list_data .list/data STZ2
   ;mbox_data .mboxes/data STZ2
@@ -205,19 +205,35 @@ JMP2r
       #01 .refresh/etc STZ
     &no_dec_pending
     .list/bytes LDZ2 .decoding/count LDZ2 NEQ2 ,&no_list JCN
+      .list scroll_to_content
       #01 .refresh/list STZ
     &no_list
     .mboxes/bytes LDZ2 .decoding/count LDZ2 NEQ2 ,&no_mbox JCN
+      .mboxes scroll_to_content
       #01 .refresh/mboxes STZ
     &no_mbox
   
 JMP2r
 
+@scroll_to_content ( listbox -- )
+
+  STHk LB_TOP LDZ2 STHrk LB_LEN LDZ2 GTH2 #00 EQU ,&nvm JCN
+    STHkr LB_LEN LDZ2 STHkr LB_HEIGHT LDZ2 SUB2
+    STHkr LB_TOP STZ2
+  &nvm
+  STHkr LB_SELECT_IDX LDZ2 STHkr LB_LEN LDZ2 GTH2 #00 EQU ,&done JCN
+    STHkr LB_LEN LDZ2 #0001 SUB2
+    STHkr LB_SELECT_IDX STZ2
+  @done
+  POPr
+JMP2r
+
+
 ( -== message out ==- )
 
 @send_get_mbox ( -- )
 
-  #01 .Console/write DEO
+  GET_MBOX .Console/write DEO
   ;selected_mbox strlen SWP .Console/write DEO .Console/write DEO
   ;selected_mbox send_str
 
@@ -340,6 +356,7 @@ JMP2r
 
 JMP2r
 
+
 ( -== input ==- )
 
 @on_key ( -> )
@@ -1315,9 +1332,9 @@ JMP2r
 ]
 
 @metadata [ 00 "taro 0a
-             "v0.2.5 0a
+             "v0.2.7 0a
              "GUI 20 "for 20 "mblaze 0a
-             "Derek 20 "Stevens 20 "<nilix@nilfm.cc> 0a 00
+             "Iris 20 "Lightshard 20 "<nilix@nilfm.cc> 0a 00
 ]
 
 @selected_mbox "INBOX 00 $f9 ( default mailbox is INBOX, total space #06 + #f9 = #ff bytes )

taro-reader

@@ -16,6 +16,8 @@ mhandle() {
       libreoffice $1;;
     application/pdf)
       zathura $1;;
+    *)
+      less $1;;
   esac
 }
 
@@ -55,8 +57,8 @@ open_attachments() {
 
 keep_track_of_mailfile() {
   orig=$1
-  stamp=${orig%,}
+  stamp=${orig%,*}
-  new=$(\ls -1 ${stamp}*)
+  new=$(echo ${stamp}*)
   printf "${new}"
 }
 
@@ -65,9 +67,9 @@ mread() {
   mflag -S ${this}
   while true; do
     this=$(keep_track_of_mailfile ${this}) 
-    if [ ! -e ${this} ]; then
+    if [ ! -e "${this}" ]; then
       printf "Looks like this email was refiled... Press Enter to close this window. "
-      read
+      read r
       break
     fi