From f43673af60286ddf97c70035ecd99e817ff846f7 Mon Sep 17 00:00:00 2001
From: "Jannis M. Hoffmann" <jannis@fehcom.de>
Date: Thu, 4 Apr 2024 12:13:29 +0200
Subject: introduce moveto3

A program to move a file descriptor to 3 required for qmail-authuser and does not require a shell
---
 src/jwebmail/__init__.py         |  2 +-
 src/jwebmail/model/read_mails.py | 58 +++++++++++++++++++---------------------
 2 files changed, 29 insertions(+), 31 deletions(-)

(limited to 'src/jwebmail')

diff --git a/src/jwebmail/__init__.py b/src/jwebmail/__init__.py
index 9663647..278ef50 100644
--- a/src/jwebmail/__init__.py
+++ b/src/jwebmail/__init__.py
@@ -34,7 +34,7 @@ else:
 
     toml_read_file = dict(load=toml_load, text=True)
 
-__version__ = "2.2.0.dev4"
+__version__ = "2.2.1.dev0"
 
 
 def validate_config(app):
diff --git a/src/jwebmail/model/read_mails.py b/src/jwebmail/model/read_mails.py
index 43f13ca..d3887ca 100644
--- a/src/jwebmail/model/read_mails.py
+++ b/src/jwebmail/model/read_mails.py
@@ -1,4 +1,3 @@
-import shlex
 import os
 from subprocess import PIPE, Popen, TimeoutExpired
 from subprocess import run as subprocess_run
@@ -202,43 +201,42 @@ class QMailAuthuser:
         idx = user_mail_addr.find("@")
         user_name = user_mail_addr[:idx]
 
-        cmdline = " ".join(
-                shlex.quote(str(x))
-                for x in (
-                    self._authenticator,
-                    self._prog,
-                    self._mailbox_path,
-                    self._virtual_user,
-                    user_name,
-                    mode,
-                )
-            )
-
-        if rp != 3:
-            cmdline += f" 3<&{rp} {rp}<&-"
+        cmdline = [
+            "moveto3.py",
+            "-a",
+            self._authenticator,
+            str(rp),
+            self._prog,
+            self._mailbox_path,
+            self._virtual_user,
+            user_name,
+            mode,
+        ]
 
         return cmdline
 
     def _read_qmauth(self, cmd, args, rp, wp):
 
-        popen = Popen(cmd, stdin=PIPE, stdout=PIPE, pass_fds=[rp], shell=True, bufsize=0)
+        with Popen(cmd, stdin=PIPE, stdout=PIPE, pass_fds=[rp], bufsize=0) as popen:
+            os.close(rp)
+            os.write(wp, f"{self._username}\0{self._password}\0\0".encode())
+            os.close(wp)
+            r = popen.stdout.read(10)
+            if popen.poll():
+                raise QMAuthError(
+                    "qmail-authuser unexpectedly exited", popen.returncode, r
+                )
+            assert r == b"OPEN\n"
+            popen.stdin.write(args)
+            popen.stdin.close()
+            inp = popen.stdout.readall()
 
-        os.close(rp)
-        os.write(wp, f"{self._username}\0{self._password}\0\0".encode())
-        os.close(wp)
-        r = popen.stdout.read(10)
-        if popen.poll():
-            raise QMAuthError("qmail-authuser unexpectedly exited", popen.returncode, r)
-        assert r == b"OPEN\n"
-        popen.stdin.write(args)
-        popen.stdin.close()
-        inp = popen.stdout.readall()
+            if popen.poll() is None:
+                popen.kill()
+                popen.poll()
 
-        if popen.poll() is None:
-            popen.kill()
-            popen.poll()
+            rc = popen.returncode
 
-        rc = popen.returncode
         if rc == 0:
             return inp
         elif rc == 3:
-- 
cgit v1.2.3