Bug 385649 - KMail renders HTML-escaped <input/> elements without having HTML-view enabled
Summary: KMail renders HTML-escaped <input/> elements without having HTML-view enabled
Status: CONFIRMED
Alias: None
Product: kmail2
Classification: Applications
Component: UI (show other bugs)
Version: 5.6.0
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-12 09:39 UTC by Dennis Schridde
Modified: 2020-05-05 22:44 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
Test case / example email (3.40 KB, message/rfc822)
2017-10-16 10:02 UTC, Dennis Schridde
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dennis Schridde 2017-10-12 09:39:36 UTC
KMail displays at the top of the email: "Note: This is an HTML message. For security reasons, only the raw HTML code is shown."

The email has following headers:
Content-Transfer-Encoding: base64
Content-Type: text/html; charset="utf-8"

When decoding using `base64 -d`, I see that it contains `<tt style="background: #ebebeb; font-size: 13px;">&lt;input type=&quot;number&quot; value=&quot;1&quot;/&gt;</tt>`

I did not "click here" to render HTML in KMail.  All HTML parts of the email are replaced using their MarkDown (?) equivalent (which is as it should be), except for the HTML-escaped <input/> element, which is actually being rendered as an input field (which is a bug).  I.e. I can enter a number or use the up/down buttons to change the value.  I.e. it is not being replaced by a pure-text string.

I would expect to see the unescaped <input type="number" value="1"/> string, instead of the rendered input field.

Version: 5.6.1 (which is not available in Bugzilla)
Package-Version: 4:17.08.1-0neon+16.04+xenial+build31
Comment 1 Laurent Montel 2017-10-12 10:17:20 UTC
Test case please :)
Comment 2 Dennis Schridde 2017-10-12 12:01:54 UTC
(In reply to Laurent Montel from comment #1)
> Test case please :)

I crafted an email in RFC 2822 form, which probably would reproduce the issue, but I have no way of testing it, because the KMail {File > Import Messages ...} menu entry is greyed out.  Hence I cannot import the message and see how KMail would render it.  How do I import messages into KMail / activate this menu entry?
Comment 3 Laurent Montel 2017-10-12 15:39:21 UTC
File->open no ?:)
Comment 4 Dennis Schridde 2017-10-16 10:02:47 UTC
Created attachment 108374 [details]
Test case / example email

The attached email demonstrates the issue.

Do you have an explanation why I can open a message but not import one?
Comment 5 Johannes Schwab 2019-01-26 14:30:46 UTC
This is not restricted to <input> tags, but works with every HTML tag.
e.g. the text

&lt;a href=&quot;#&quot;&gt;test&lt;/a&gt;

in a HTML-only mail will produce an actual link when viewed in the "save HTML code only view", but renders as expected after allowing HTML.