Bug 385649

Summary: KMail renders HTML-escaped <input/> elements without having HTML-view enabled
Product: [Applications] kmail2 Reporter: Dennis Schridde <dennis.schridde>
Component: UIAssignee: kdepim bugs <pim-bugs-null>
Status: CONFIRMED ---    
Severity: normal CC: bugs.kde, montel, null
Priority: NOR    
Version First Reported In: 5.6.0   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:
Attachments: Test case / example email

Description Dennis Schridde 2017-10-12 09:39:36 UTC 
KMail displays at the top of the email: "Note: This is an HTML message. For security reasons, only the raw HTML code is shown."

The email has following headers:
Content-Transfer-Encoding: base64
Content-Type: text/html; charset="utf-8"

When decoding using `base64 -d`, I see that it contains `<tt style="background: #ebebeb; font-size: 13px;">&lt;input type=&quot;number&quot; value=&quot;1&quot;/&gt;</tt>`

I did not "click here" to render HTML in KMail.  All HTML parts of the email are replaced using their MarkDown (?) equivalent (which is as it should be), except for the HTML-escaped <input/> element, which is actually being rendered as an input field (which is a bug).  I.e. I can enter a number or use the up/down buttons to change the value.  I.e. it is not being replaced by a pure-text string.

I would expect to see the unescaped <input type="number" value="1"/> string, instead of the rendered input field.

Version: 5.6.1 (which is not available in Bugzilla)
Package-Version: 4:17.08.1-0neon+16.04+xenial+build31
Comment 1 Laurent Montel 2017-10-12 10:17:20 UTC 
Test case please :)
Comment 2 Dennis Schridde 2017-10-12 12:01:54 UTC 
(In reply to Laurent Montel from comment #1)
> Test case please :)

I crafted an email in RFC 2822 form, which probably would reproduce the issue, but I have no way of testing it, because the KMail {File > Import Messages ...} menu entry is greyed out.  Hence I cannot import the message and see how KMail would render it.  How do I import messages into KMail / activate this menu entry?
Comment 3 Laurent Montel 2017-10-12 15:39:21 UTC 
File->open no ?:)
Comment 4 Dennis Schridde 2017-10-16 10:02:47 UTC 
Created attachment 108374 [details]
Test case / example email

The attached email demonstrates the issue.

Do you have an explanation why I can open a message but not import one?
Comment 5 Johannes Schwab 2019-01-26 14:30:46 UTC 
This is not restricted to <input> tags, but works with every HTML tag.
e.g. the text

&lt;a href=&quot;#&quot;&gt;test&lt;/a&gt;

in a HTML-only mail will produce an actual link when viewed in the "save HTML code only view", but renders as expected after allowing HTML.