Bug 332036

Summary: a new line is inserted in a openPGP signed email during viewing, thus invalidating the signature
Product: [Applications] kmail2 Reporter: pt8614-599
Component: cryptoAssignee: kdepim bugs <kdepim-bugs>
Status: RESOLVED FIXED    
Severity: normal CC: aheinecke, ecthelion, sknauss
Priority: NOR    
Version: 4.12.4   
Target Milestone: ---   
Platform: openSUSE   
OS: Linux   
Latest Commit: Version Fixed In: 4.14.7
Sentry Crash Report:
Attachments: a test email
public key

Description pt8614-599 2014-03-11 16:57:09 UTC
Kmail inserts a unneccessary new line in some emails. This breaks the signature of an email signed with openPGP. As far as I can tell, this happens if an email contains only one emtpy line after a statement like "Content-Type: multipart/mixed;". An email client producing such emails with only one empty line at this position is Claws Mail. I tried to save the affected email in mbox format and remove the unnecessary emtpy line manually. However, the line is immediatly inserted again by Kmail after opening the edited mbox file.

Reproducible: Always

Steps to Reproduce:
1. Compose an email with Claws Mail which will include a line like "Content-Type: multipart/mixed;". This will be the case for an email with some text and an atachment.
2. Sign the email with Claws Mail and send it to your email account.
3. Open the email with Kmail.
Actual Results:  
You will receive the email. By viewing the source code of the email you will find something like the following. I removed most of the header information for privacy reasons. I put three stars (*) in the unnecessary new line.

X-Mailer: Claws Mail 3.9.3-30-gd68093 (GTK+ 2.16.6; i586-pc-mingw32msvc)
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 boundary="Sig_/u/z1VefiYFhYJHm7c6Dxhb3"; protocol="application/pgp-signature"


--Sig_/u/z1VefiYFhYJHm7c6Dxhb3
Content-Type: multipart/mixed; boundary="MP_/0V4bucav=QSQP4BOuQ_gRp3"

***
--MP_/0V4bucav=QSQP4BOuQ_gRp3
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

POC

--MP_/0V4bucav=QSQP4BOuQ_gRp3
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename=poc.txt

alle meine entchen schwimmen auf dem see

--MP_/0V4bucav=QSQP4BOuQ_gRp3--

--Sig_/u/z1VefiYFhYJHm7c6Dxhb3
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQIcBAEBAgAGBQJTHyYqAAoJED4gX7ArrgThXiMP/RkDXPwMtPV8vSOOe6mY6TAp
r19T1aTU+qyPG6riBvrreGIhoFz4mlCTiA8eWUElcSVdhdOjLTdB+ejKow0uGG1O
1Bsogugm+fwb9eAxoXKea5EpYMHoYV/eDz1qutvfwciFhGHN8ilABBF+smZ58T2T
u3z32ZFMbNGQyObkdrKEUb62qk16q6ZaCTwscnFfoF2yurwOZJp4FJ/ckEOXjVwq
ZhR/7rfg4x5zM7hYZA66/FlEeHrTp31GBDlfySwy7NCdmsXwX0TDLXofxtnDITKa
ixVdMC/7Qw8abx6EofsJVy1PBQxvL6lgnsabtOFPsyOjYG7wqvX4RB46wf9HZ8t4
z9/StG+fkxv/niE/hveWkUv2/RyKYHaICFcEKHpW1R/fWx2Kp0iABImrExVPKKYC
NEIzYMKchuAf+p6QmPLo12If2OrFjKJIyDdZT0zgeaLU1A9K+kOWw57m4O9E8pU5
+dCQ1/GvSRlm3NLy16jb/TRsio26YwWh3dmpmkcmDBmpOK/SimqKb2OhIQyTXqGg
lvfTQmA0O+5TMT0fF+9OZHUmuXMLmDmNHf3KQoBYvFOIejnypEyxa04+y0qMmnVu
GWwdJZAcN5BVTAbSA+27RGdiNbK1LQ2DwgLuoUb6Bt424Dac8QysGdDzKSbyN4tF
mKkb3QcJiafNe0pYsCsj
=ZWuM
-----END PGP SIGNATURE-----

--Sig_/u/z1VefiYFhYJHm7c6Dxhb3--


Expected Results:  
Here is the message orignally sent by Claws Mail. Please notice that there is only one empty line after the Content-Type: multipart/mixed; boundary="MP_/0V4bucav=QSQP4BOuQ_gRp3":

X-Mailer: Claws Mail 3.9.3-30-gd68093 (GTK+ 2.16.6; i586-pc-mingw32msvc)
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 boundary="Sig_/u/z1VefiYFhYJHm7c6Dxhb3"; protocol="application/pgp-signature"


--Sig_/u/z1VefiYFhYJHm7c6Dxhb3
Content-Type: multipart/mixed; boundary="MP_/0V4bucav=QSQP4BOuQ_gRp3"

--MP_/0V4bucav=QSQP4BOuQ_gRp3
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

POC

--MP_/0V4bucav=QSQP4BOuQ_gRp3
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment; filename=poc.txt

alle meine entchen schwimmen auf dem see

--MP_/0V4bucav=QSQP4BOuQ_gRp3--

--Sig_/u/z1VefiYFhYJHm7c6Dxhb3
Content-Type: application/pgp-signature; name=signature.asc
Content-Disposition: attachment; filename=signature.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQIcBAEBAgAGBQJTHyYqAAoJED4gX7ArrgThXiMP/RkDXPwMtPV8vSOOe6mY6TAp
r19T1aTU+qyPG6riBvrreGIhoFz4mlCTiA8eWUElcSVdhdOjLTdB+ejKow0uGG1O
1Bsogugm+fwb9eAxoXKea5EpYMHoYV/eDz1qutvfwciFhGHN8ilABBF+smZ58T2T
u3z32ZFMbNGQyObkdrKEUb62qk16q6ZaCTwscnFfoF2yurwOZJp4FJ/ckEOXjVwq
ZhR/7rfg4x5zM7hYZA66/FlEeHrTp31GBDlfySwy7NCdmsXwX0TDLXofxtnDITKa
ixVdMC/7Qw8abx6EofsJVy1PBQxvL6lgnsabtOFPsyOjYG7wqvX4RB46wf9HZ8t4
z9/StG+fkxv/niE/hveWkUv2/RyKYHaICFcEKHpW1R/fWx2Kp0iABImrExVPKKYC
NEIzYMKchuAf+p6QmPLo12If2OrFjKJIyDdZT0zgeaLU1A9K+kOWw57m4O9E8pU5
+dCQ1/GvSRlm3NLy16jb/TRsio26YwWh3dmpmkcmDBmpOK/SimqKb2OhIQyTXqGg
lvfTQmA0O+5TMT0fF+9OZHUmuXMLmDmNHf3KQoBYvFOIejnypEyxa04+y0qMmnVu
GWwdJZAcN5BVTAbSA+27RGdiNbK1LQ2DwgLuoUb6Bt424Dac8QysGdDzKSbyN4tF
mKkb3QcJiafNe0pYsCsj
=ZWuM
-----END PGP SIGNATURE-----

--Sig_/u/z1VefiYFhYJHm7c6Dxhb3--


The problem exists independly from the operation system. It occurs in mails sent from a windows machine as well as in mails sent form a linux machine. Therefore is propably not related to a conversion in line endings.

Maybe this bug is related to https://bugs.kde.org/show_bug.cgi?id=331991. However, the email in may case is not piped through anything.
Comment 1 Sandro Knauß 2014-03-30 20:35:23 UTC
Because Bug 331991 has a text mail, i'm really sure that kmail can work with new lines in the header. And you can use "save as"  to store this kind of brocken mail.

The best would be if you can add a test mail with a signature that is shown broken.
Comment 2 pt8614-599 2014-03-31 08:55:38 UTC
Created attachment 85865 [details]
a test email
Comment 3 pt8614-599 2014-03-31 08:57:54 UTC
Created attachment 85866 [details]
public key

to verify the signature of the test mail, you will need this public key
Comment 4 Sandro Knauß 2014-03-31 09:26:38 UTC
Now I can confirm your bug. And made sure that the signature is valid via cmdline.

I'll will look into it.
Comment 5 Michał Goliński 2014-04-22 14:41:33 UTC
Seems to be the same as:

https://bugs.kde.org/show_bug.cgi?id=332973

Only there it is about X.509 signatures.
Comment 6 Andre Heinecke 2014-10-14 14:09:01 UTC
I also ran into this and thought it to be a Kmail1 bug as even the exported mails and if you forward such a mail as an attachment results in a corrupted signature.

If you send an OpenPGP mail with attachment from KMail1 to KMail2 it will not verify because of this.
https://roundup.kolab.org/issue4872
Comment 7 Sandro Knauß 2015-03-15 13:21:19 UTC
Git commit abca7ffa2be4664bfeee381a08532bf37fd98bcb by Sandro Knauß.
Committed on 13/03/2015 at 20:54.
Pushed by knauss into branch 'KDE/4.14'.

KMIME: Do not add additional newlines, while parsing mails.

If testing the signature status of mails, than nothing is allowed to
change. Because the number of newlines, that seperates head and body is
not specified. So make sure that at least two are written.
Related: bug 332973
FIXED-IN: 15.04

M  +9    -6    kmime/kmime_content.cpp
M  +4    -1    kmime/kmime_header_parsing.cpp
M  +0    -1    kmime/tests/auto/contenttest.cpp
M  +23   -3    kmime/tests/auto/messagetest.cpp
M  +1    -0    kmime/tests/auto/messagetest.h
A  +49   -0    kmime/tests/data/mails/dontchangemail.mbox

http://commits.kde.org/kdepimlibs/abca7ffa2be4664bfeee381a08532bf37fd98bcb
Comment 8 Sandro Knauß 2015-03-15 13:28:29 UTC
Git commit 90517fa3777615a801236787e11b691480720370 by Sandro Knauß.
Committed on 13/03/2015 at 20:54.
Pushed by knauss into branch 'KDE/4.14'.

KMIME: Do not add additional newlines, while parsing mails.

If testing the signature status of mails, than nothing is allowed to
change. Because the number of newlines, that seperates head and body is
not specified. So make sure that at least two are written.
Related: bug 332973
FIXED-IN: 4.14.7
REVIEW: 122933

M  +18   -12   kmime/kmime_content.cpp
M  +4    -1    kmime/kmime_header_parsing.cpp
M  +0    -1    kmime/tests/auto/contenttest.cpp
M  +22   -3    kmime/tests/auto/messagetest.cpp
M  +1    -0    kmime/tests/auto/messagetest.h
A  +49   -0    kmime/tests/data/mails/dontchangemail.mbox

http://commits.kde.org/kdepimlibs/90517fa3777615a801236787e11b691480720370