From 47c7145f3bcb28561cfe092832e71ae0bf168bb8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 4 Mar 2026 19:56:40 +0000 Subject: [PATCH 1/2] Initial plan From 7121a563083d67c1c6aa20b9d1d9f0a616dd695d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 4 Mar 2026 19:59:52 +0000 Subject: [PATCH 2/2] Escape Rich markup in all user-controlled MessageHeader values Co-authored-by: slosar <1197186+slosar@users.noreply.github.com> --- bor/tabs/message.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/bor/tabs/message.py b/bor/tabs/message.py index 8908b4e..2b8fccb 100644 --- a/bor/tabs/message.py +++ b/bor/tabs/message.py @@ -139,39 +139,39 @@ def _format_headers(self) -> str: lines = [] # From - lines.append(f"[bold]From:[/bold] {self.message.from_addr}") + lines.append(f"[bold]From:[/bold] {rich_escape(str(self.message.from_addr))}") # Show effective reply address when it differs from From if self.message.list_post_addr and self.message.list_post_addr.email: # Mailing list: show the list address (this is where 'r' will send) if self.message.list_post_addr.email != self.message.from_addr.email: - lines.append(f"[bold]List:[/bold] {self.message.list_post_addr.email}") + lines.append(f"[bold]List:[/bold] {rich_escape(self.message.list_post_addr.email)}") elif (self.message.reply_to_addr and self.message.reply_to_addr.email != self.message.from_addr.email): - lines.append(f"[bold]Reply-To:[/bold] {self.message.reply_to_addr}") + lines.append(f"[bold]Reply-To:[/bold] {rich_escape(str(self.message.reply_to_addr))}") # To - to_list = ", ".join(str(addr) for addr in self.message.to_addrs) + to_list = rich_escape(", ".join(str(addr) for addr in self.message.to_addrs)) lines.append(f"[bold]To:[/bold] {to_list}") # CC if self.message.cc_addrs: - cc_list = ", ".join(str(addr) for addr in self.message.cc_addrs) + cc_list = rich_escape(", ".join(str(addr) for addr in self.message.cc_addrs)) lines.append(f"[bold]CC:[/bold] {cc_list}") # BCC (only in full header mode) if self.show_full and self.message.bcc_addrs: - bcc_list = ", ".join(str(addr) for addr in self.message.bcc_addrs) + bcc_list = rich_escape(", ".join(str(addr) for addr in self.message.bcc_addrs)) lines.append(f"[bold]BCC:[/bold] {bcc_list}") # Date date_str = "" if self.message.date: date_str = self.message.date.strftime("%Y-%m-%d %H:%M:%S %Z") - lines.append(f"[bold]Date:[/bold] {date_str}") + lines.append(f"[bold]Date:[/bold] {rich_escape(date_str)}") # Subject - lines.append(f"[bold]Subject:[/bold] {self.message.subject}") + lines.append(f"[bold]Subject:[/bold] {rich_escape(str(self.message.subject))}") # Attachments count if self.message.attachments: