Menu
▾
▴
gmailagent-devel — List should be used by developers aswell as users
You can subscribe to this list here.
| 2005 |
Jan
|
Feb
|
Mar
|
Apr
(1) |
May
(6) |
Jun
(42) |
Jul
(1) |
Aug
(1) |
Sep
(74) |
Oct
(1) |
Nov
(3) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2006 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(2) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Stas Z <sta...@gm...> - 2005-09-22 15:43:14
|
Release time again :-/ Released version 0.1.3.1 This is yet another bugfix release, this one is tested until all my Gmail accounts were locked down by Gmail ;-) It fixes the problem that not all the messages were retrieved on larger mes= sage threads. Download: http://sourceforge.net/project/showfiles.php?group_id=3D113492&package_id= =3D122807 Cheers, Stas -- A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-21 19:48:52
|
On 9/21/05, Sebastien Delafond <sde...@gm...> wrote: > Unfortunately this doesn't fix gmailfs: I am still getting errors on First of all, I know nothing about gmailfs, but I see some trouble spots. [...] > ~ # sudo touch /mnt/test > Empty account > Traceback (most recent call last): > File "/usr/share/gmailfs/gmailfs.py", line 1094, in getinodemsg > return thread._messages[len(thread._messages)-1] > IndexError: list index out of range Just guessing here, but I suspect this is the GmailThread._messages attribu= te. If so it's better not to use attributes directly but to use the API Further more if indeed GmailThread._messages is used, this class hasn't changed since libgmail version 0.1.0. [....] > And then listing it doesn't yield an exception, but something even > weirder: > > ~ # sudo ls /mnt/bar > Empty account Yet another result of accessing class attributes directly rather then through an API. It's part of a exception catch I added to test for empty message threads. I suspect because gmailfs interacts with the internal message threads rather then through an API, it gets into trouble because there are changes to these int= ernal class attributes. > > Has there been an API change somewhere, among all those > bugfixes/security fixes ? Changes yes, to an API no. I hope richard can comment on this, because I don't know how gmailfs (ab)us= es libgmail. Stas -- A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Sebastien D. <sde...@gm...> - 2005-09-21 19:19:13
|
Unfortunately this doesn't fix gmailfs: I am still getting errors on
the gmailfs share, mounted on /mnt:
~ # sudo ls /mnt
~ #
This is fine, as my share is a new one, so it's empty. But then:
~ # sudo touch /mnt/test
Empty account
Traceback (most recent call last):
File "/usr/share/gmailfs/gmailfs.py", line 1094, in getinodemsg
return thread._messages[len(thread._messages)-1]
IndexError: list index out of range
Yet the file has been created:
~ # sudo ls /mnt
test
~ #
Another quirk appears when you create a directory:
~ # sudo mkdir /mnt/bar
Empty account
Traceback (most recent call last):
File "/usr/share/gmailfs/gmailfs.py", line 1094, in getinodemsg
return thread._messages[len(thread._messages)-1]
IndexError: list index out of range
And then listing it doesn't yield an exception, but something even
weirder:
~ # sudo ls /mnt/bar
Empty account
Has there been an API change somewhere, among all those
bugfixes/security fixes ?
Cheers,
--Seb
|
|
From: Stas Z <sta...@gm...> - 2005-09-21 18:32:08
|
Hello, I've released version 0.1.3. This release fixes a number of bugs that leads to a crash when accessing small or empty accounts. Also the problem that not all the messaged were returned in large accounts is resolved. To download: http://sourceforge.net/project/showfiles.php?group_id=3D113492&package_id= =3D122807 Stas -- A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-21 05:58:46
|
On 9/21/05, Waseem S. Daher <wd...@mi...> wrote: > On Tue, 20 Sep 2005, Stas Z wrote: > > > I'll fix this at a later date -- it'll probably just be a quick chang= e. > > Hmm, it's a nasty problem, gmailfs seems to crash due to the empty > > account error. > > When do you have the time to fix it? >=20 > I can certainly do it sometime this weekend. > I doubt I'll be able to do it any sooner than that, though (yay classes) I'm free of work today, I'll see if I can fix it. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Waseem S. D. <wd...@MI...> - 2005-09-20 22:09:18
|
On Tue, 20 Sep 2005, Stas Z wrote: > > I'll fix this at a later date -- it'll probably just be a quick change. > Hmm, it's a nasty problem, gmailfs seems to crash due to the empty > account error. > When do you have the time to fix it? I can certainly do it sometime this weekend. I doubt I'll be able to do it any sooner than that, though (yay classes) - Waseem |
|
From: Stas Z <sta...@gm...> - 2005-09-20 15:22:56
|
---------- Forwarded message ---------- From: SourceForge.net <no...@so...> Date: Sep 20, 2005 4:53 PM Subject: [ libgmail-Bugs-1295794 ] 1.2 fails when fetching messages To: no...@so... Bugs item #1295794, was opened at 2005-09-19 23:23 Message generated for change (Comment added) made by stas_zytkiewicz You can respond by visiting: https://sourceforge.net/tracker/?func=3Ddetail&atid=3D665330&aid=3D1295794&= group_id=3D113492 Please note that this message will contain a full copy of the comment threa= d, including the initial issue submission, for this request, not just the latest update. Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Nobody/Anonymous (nobody) Assigned to: Nobody/Anonymous (nobody) Summary: 1.2 fails when fetching messages Initial Comment: 1.1 works fine, but 1.2 gives me: Traceback (most recent call last): File "/usr/local/libgmail/demos/archive.py", line 65, in ? result =3D ga.getMessagesByLabel(name, True) File "/usr/lib/python2.3/site-packages/libgmail.py", line 487, in getMessagesByLabel cat=3Dlabel, allPages =3D allPages) File "/usr/lib/python2.3/site-packages/libgmail.py", line 422, in _parseThreadSearch return GmailSearchResult(self, (searchType, kwargs), threadsInfo) File "/usr/lib/python2.3/site-packages/libgmail.py", line 1090, in __init__ self._threads =3D [GmailThread(self, thread) for thread in threadsInfo[0]] File "/usr/lib/python2.3/site-packages/libgmail.py", line 1178, in __init__ self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical updated? TypeError: unsubscriptable object This is when trying to fetch two messages with a label I assigned to them. joh...@gm... ---------------------------------------------------------------------- >Comment By: Stas Zytkiewicz (stas_zytkiewicz) Date: 2005-09-20 16:53 Message: Logged In: YES user_id=3D1250429 Thanks for reporting this bug. We are aware of this problem and we are working on a fix asap. I also must inform you that versions < 1.2 have a serious security bug so if it's possible don't use those versions. Regards, Stas ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=3Ddetail&atid=3D665330&aid=3D1295794&= group_id=3D113492 --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-20 13:33:18
|
On 9/19/05, Waseem S. Daher <wd...@mi...> wrote: > Interesting. I tested it again and it works on one gmail account but not > on another -- the one that it doesn't work on has no messages in it. So > I suspect that either the quota info isn't sent when that is the case, > or we're choking on it. >=20 > But all the other tests also pass. So this is not a release-blocker, > especially given the severity of the security exploit. >=20 > I'll fix this at a later date -- it'll probably just be a quick change. Hmm, it's a nasty problem, gmailfs seems to crash due to the empty account error. When do you have the time to fix it? Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Andrew L. <one...@gm...> - 2005-09-20 13:31:38
|
"BTW, you should use the latest release from sourceforge, it can't be guaranteed that the CVS will contain a proper working libgmail." Perhaps it's time to change this: "Please note: Always download and test the CVS version of libgmail if you are having problems. The most recent packaged version no longer works correctly. The current development status means critical errors caused by changes at Gmail will be corrected as soon as possible in CVS, if the author is notified about the issue." On 9/20/05, Stas Z <sta...@gm...> wrote: > On 9/20/05, follower <fol...@my...> wrote: > > > > > > > > ---------- Forwarded message ---------- > > From: Mike Varak <var...@gm...> > > To: "fol...@my..." <fol...@my...> > > Date: Mon, 19 Sep 2005 18:12:31 -0700 > > Subject: libgmail problem > > Hi > > > > Am I broken or is libgmail? Using version from CVS today... > I hope libgmail is and not you :-) > > The error you reported is a known bug which seems to be related to > a empty account. Can you confirm that the account your trying to > access is empty, I mean it has no messages. > > BTW, you should use the latest release from sourceforge, it can't > be guaranteed that the CVS will contain a proper working libgmail. > > Regards, > Stas Zytkiewicz > > > Thanks > > > > Mike > > > > > > pbx:/usr/src/libgmail# python libgmail.py > > Gmail account name: varakdrive > > Password: > > > > Please wait, logging in... > > Login successful. > > > > Traceback (most recent call last): > > File "libgmail.py", line 1426, in ? > > quotaInfo =3D ga.getQuotaInfo() > > File "libgmail.py", line 466, in getQuotaInfo > > self.getMessagesByFolder(U_INBOX_SEARCH) > > File "libgmail.py", line 446, in getMessagesByFolder > > return self._parseThreadSearch(folderName, allPages =3D > > allPages) > > File "libgmail.py", line 422, in _parseThreadSearch > > return GmailSearchResult(self, (searchType, kwargs), threadsInfo) > > File "libgmail.py", line 1090, in __init__ > > self._threads =3D [GmailThread(self, thread) for thread in > > threadsInfo[0]] > > File "libgmail.py", line 1178, in __init__ > > self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical > > updated? > > TypeError: unsubscriptable object > > > > > > > > > > > -- > A nation that continues year after year to spend more money on military d= efense > than on programs of social uplift is approaching spiritual doom. > Martin Luther King, Jr. > > > ------------------------------------------------------- > SF.Net email is sponsored by: > Tame your development challenges with Apache's Geronimo App Server. > Download it for free - -and be entered to win a 42" plasma tv or your ver= y > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php > _______________________________________________ > Gmailagent-devel mailing list > Gma...@li... > https://lists.sourceforge.net/lists/listinfo/gmailagent-devel > |
|
From: Stas Z <sta...@gm...> - 2005-09-20 13:27:54
|
On 9/20/05, follower <fol...@my...> wrote: >=20 >=20 >=20 > ---------- Forwarded message ---------- > From: Mike Varak <var...@gm...> > To: "fol...@my..." <fol...@my...> > Date: Mon, 19 Sep 2005 18:12:31 -0700 > Subject: libgmail problem > Hi > =20 > Am I broken or is libgmail? Using version from CVS today... I hope libgmail is and not you :-) =20 The error you reported is a known bug which seems to be related to a empty account. Can you confirm that the account your trying to access is empty, I mean it has no messages. BTW, you should use the latest release from sourceforge, it can't be guaranteed that the CVS will contain a proper working libgmail. Regards, Stas Zytkiewicz =20 > Thanks > =20 > Mike > =20 > =20 > pbx:/usr/src/libgmail# python libgmail.py > Gmail account name: varakdrive > Password: > =20 > Please wait, logging in... > Login successful. > =20 > Traceback (most recent call last): > File "libgmail.py", line 1426, in ? > quotaInfo =3D ga.getQuotaInfo() > File "libgmail.py", line 466, in getQuotaInfo > self.getMessagesByFolder(U_INBOX_SEARCH) > File "libgmail.py", line 446, in getMessagesByFolder > return self._parseThreadSearch(folderName, allPages =3D > allPages) > File "libgmail.py", line 422, in _parseThreadSearch > return GmailSearchResult(self, (searchType, kwargs), threadsInfo) > File "libgmail.py", line 1090, in __init__ > self._threads =3D [GmailThread(self, thread) for thread in > threadsInfo[0]] > File "libgmail.py", line 1178, in __init__ > self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical > updated? > TypeError: unsubscriptable object > =20 > =20 > =20 >=20 --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Richard J. <jo...@gm...> - 2005-09-20 10:22:23
|
Unfortunately this release breaks gmailfs for me. I'm able to get old
functionality back by applying this patch:
--- libgmail-orig.py 2005-09-20 19:50:01.000000000 +1000
+++ libgmail.py 2005-09-20 19:50:06.000000000 +1000
@@ -1087,7 +1087,7 @@
"""
self._account =3D account
self.search =3D search # TODO: Turn into object + format nicely.
- self._threads =3D [GmailThread(self, thread) for thread in
threadsInfo[0]]
+ self._threads =3D [GmailThread(self, thread) for thread in threads=
Info]
=20
=20
def __iter__(self):
but I don't know if this has any collateral damage for the rest of the
libgmail code.
Regards,
Richard.
On 9/19/05, Stas Z <sta...@gm...> wrote:
> Hello
>=20
> Just released libgmail 0.1.2.
> This is a security upgrade which fixes the page parser bug which is consi=
dered a
> critical security bug.
>=20
> Every user of libgmail *must* upgrade to this version.
>=20
> Download:
> http://sourceforge.net/project/showfiles.php?group_id=3D113492&package_id=
=3D122807
>=20
> Cheers,
> Stas
>=20
> --
> A nation that continues year after year to spend more money on military d=
efense
> than on programs of social uplift is approaching spiritual doom.
> Martin Luther King, Jr.
>
|
|
From: Stas Z <sta...@gm...> - 2005-09-19 16:42:38
|
On 9/19/05, Waseem S. Daher <wd...@mi...> wrote: > Interesting. I tested it again and it works on one gmail account but not > on another -- the one that it doesn't work on has no messages in it. So > I suspect that either the quota info isn't sent when that is the case, > or we're choking on it. There are some other issues also with labels with no messages. So there's more work to be done :-) =20 > But all the other tests also pass. So this is not a release-blocker, > especially given the severity of the security exploit. Indeed, that's why I released this afternoon.(GMT+2) =20 > I'll fix this at a later date -- it'll probably just be a quick change. Just a try/except I'll guess. It might be good to have a TODO inside the CVS, there are also some feature requests that makes sense. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Waseem S. D. <wd...@MI...> - 2005-09-19 16:17:54
|
Interesting. I tested it again and it works on one gmail account but not on another -- the one that it doesn't work on has no messages in it. So I suspect that either the quota info isn't sent when that is the case, or we're choking on it. But all the other tests also pass. So this is not a release-blocker, especially given the severity of the security exploit. I'll fix this at a later date -- it'll probably just be a quick change. - W On Mon, 2005-09-19 at 15:18 +0200, Stas Z wrote: > I don't know were the problem come from but I have tested it on a number of > machines and libgmail works OK. (Linux only systems) |
|
From: Andrew L. <one...@gm...> - 2005-09-19 13:24:57
|
Hi all,
On exec vs. eval: just to be clear, I'm not claiming that exec is any
safer than eval; it obviously isn't. The reasons I think it's safer
in this case have to do with how it's used. First, since the
preprocessing required is much more rudimentary, it's much less likely
that we'll get something other than the actual Google-supplied
Javascript, and much less likely that said something else would be
syntactically correct. Second, since it sets __builtins__ to None,
even a malicious Google programmer will have to work pretty hard to
break into the surrounding system.
By the way, you can get the same safety with eval:
>>> eval('open("f")', {'__builtins__': None}, {})
Traceback (most recent call last):
File "<pyshell#0>", line 1, in -toplevel-
eval('open("f")', {'__builtins__': None}, {})
File "<string>", line 0, in -toplevel-
NameError: name 'open' is not defined
Now that I think about it, this would have been the fast way to plug
the hole. I guess it's a case of tunnel vision that I didn't realize
and mention this before! On the other hand, it's still a hole of the
"make libgmail eat up all available memory" variety, since you can
still evaluate, say, [0] * 1000000000.
I definitely agree that in the end we (both) need an actual
text-processing parser.
Andrew
On 9/19/05, Stas Z <sta...@gm...> wrote:
> On 9/19/05, follower <fol...@my...> wrote:
> >
> > > Please check the libgmail version currently in CVS because we must re=
lease
> > > as soon as possible.
> > I think it would be best to avoid "exec" too--there's really no way to
> > safely handle arbitrary code in Python. (Hence the removal of the rexec
> > module.) It would be better to use a simple parser.
> I agree, but we use exec to parse the javascript from the Gmail pages.
> This way we only have a problem when the Gmail developers add malicious
> javascript.
> None the less, I know exec can be a problem but at this moment it's a lot
> safer then the former solution.
>=20
> > I can't give the code a thorough look through at the moment...
> >
> > > PS, Because this bug has such a high risk, especially on Windows, I s=
uggest
> > > that we don't make the exploit code public. At least not for a few we=
eks.
> > Do as you see fit, but I think we should say people should stop using
> > previous versions and upgrade immediately.
> I meant not to disclose the actual way to exploit this. It's *very* impor=
tant
> indeed to inform our users about the problem.
>=20
> BTW, the actual exploit *and* solution came from Andrew.
>=20
> Stas
>=20
> --
> A nation that continues year after year to spend more money on military d=
efense
> than on programs of social uplift is approaching spiritual doom.
> Martin Luther King, Jr.
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by:
> Tame your development challenges with Apache's Geronimo App Server.
> Download it for free - -and be entered to win a 42" plasma tv or your ver=
y
> own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
> _______________________________________________
> Gmailagent-devel mailing list
> Gma...@li...
> https://lists.sourceforge.net/lists/listinfo/gmailagent-devel
>
|
|
From: Stas Z <sta...@gm...> - 2005-09-19 13:18:53
|
On 9/19/05, Andrew Lin <one...@gm...> wrote: > Hi Stas, >=20 > On the first point, the traceback he posted is from CVS revision 1.59; > I suggested he add the [] in 1.60 to turn the 2.4-only generator > expression into a 2.0+ (?) compatible list comprehension. I can't > imagine how that fix could have caused trouble. I don't know were the problem come from but I have tested it on a number of machines and libgmail works OK. (Linux only systems) =20 > I have a Linux machine running 2.3 available, but won't have time to > actually work on anything until at least this evening, possibly much > later. So if Waseem or someone can check the code before then that > would be better. I still hope someone can test it a bit more but as you probably noticed I released libgmail just a few moments ago. I feel the bug is to severe to hold off the release even if the test cycle is very short this time :-/ BTW, I rather recieve mails like: " Hello, nice app but it crashes, can you help me?" Instead of: "AAARG, I'm hacked, my life is ruined, I hate you !!!" :-) Cheers, Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Andrew L. <one...@gm...> - 2005-09-19 13:04:10
|
Hi Stas, On the first point, the traceback he posted is from CVS revision 1.59; I suggested he add the [] in 1.60 to turn the 2.4-only generator expression into a 2.0+ (?) compatible list comprehension. I can't imagine how that fix could have caused trouble. I have a Linux machine running 2.3 available, but won't have time to actually work on anything until at least this evening, possibly much later. So if Waseem or someone can check the code before then that would be better. Andrew On 9/19/05, Stas Z <sta...@gm...> wrote: > On 9/18/05, Waseem S. Daher <wd...@mi...> wrote: > > Stas- > > > > Thanks for all your hard work! > > Right now when I run the latest CVS version, I get the following error: > > > > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py > > File "libgmail.py", line 93 > > data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ','= , > > ']']) > > ^ > > SyntaxError: invalid syntax > I suspect that your copy of libgmail.py is corrupted. I assume that you > cut and paste the above traceback. > The correct line is: > data =3D '\n'.join([x for x in lines if x and x[0] in ['D', ')', ',', ']'= ]]) > . ^^^ >=20 > When I test it with Python2.3: > stas@mobi:~/CVS-WORK/libgmail$ python2.3 libgmail.py > Gmail account name: gatester1 > Password: >=20 > Please wait, logging in... > Login successful. >=20 > 23 MB of 2608 MB used. (1%) >=20 > Select folder or label to list: (Ctrl-C to exit) > 0. inbox > 1. starred > 2. all > 3. drafts > 4. sent > 5. spam > Choice: 0 >=20 >=20 > 105ede6be44ce5b9 2 test mail > 1045b58fffb35c40 1 test mail > 105ede6be44ce5b9 2 Re: test mail > ...... > ...... >=20 > Can you check your copy of libgmail.py? >=20 > > Also, I uncommented a 'deal with multiline notes fields in contacts', > > and that test does not yet pass for some reason. I'll try to investigat= e > > further. I /have/ checked in this version of testlibgmail.py though. > OK, but I suggest that we release libgmail as it is now *after* you > check that you can > run it on your Python2.3 system. >=20 > Stas >=20 > -- > A nation that continues year after year to spend more money on military d= efense > than on programs of social uplift is approaching spiritual doom. > Martin Luther King, Jr. >=20 >=20 > ------------------------------------------------------- > SF.Net email is sponsored by: > Tame your development challenges with Apache's Geronimo App Server. > Download it for free - -and be entered to win a 42" plasma tv or your ver= y > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php > _______________________________________________ > Gmailagent-devel mailing list > Gma...@li... > https://lists.sourceforge.net/lists/listinfo/gmailagent-devel > |
|
From: Stas Z <sta...@gm...> - 2005-09-19 12:57:44
|
Hello Just released libgmail 0.1.2. This is a security upgrade which fixes the page parser bug which is conside= red a critical security bug. Every user of libgmail *must* upgrade to this version. Download: http://sourceforge.net/project/showfiles.php?group_id=3D113492&package_id= =3D122807 Cheers, Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-19 12:30:23
|
Hello, just to inform you: Libgmail does not support multiple lines in the contacts notes nor does it support the 'extended' notes. This will be resolved in the near future. The problem with the notes is that for every note a new page request has to= be send to Gmail. This can be regarded as a DOS like attack on the Gmail serve= rs. There are reports of users who's account is disabled as a result of this. Currently libgmail supports only the first line from the notes which is taken from the contacts list. I also disabled the notes test in the testsuite. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-19 10:25:47
|
On 9/19/05, follower <fol...@my...> wrote: > > > Please check the libgmail version currently in CVS because we must rele= ase > > as soon as possible. > I think it would be best to avoid "exec" too--there's really no way to > safely handle arbitrary code in Python. (Hence the removal of the rexec > module.) It would be better to use a simple parser. I agree, but we use exec to parse the javascript from the Gmail pages. This way we only have a problem when the Gmail developers add malicious javascript. None the less, I know exec can be a problem but at this moment it's a lot safer then the former solution. =20 > I can't give the code a thorough look through at the moment... >=20 > > PS, Because this bug has such a high risk, especially on Windows, I sug= gest > > that we don't make the exploit code public. At least not for a few week= s. > Do as you see fit, but I think we should say people should stop using > previous versions and upgrade immediately. I meant not to disclose the actual way to exploit this. It's *very* importa= nt indeed to inform our users about the problem. BTW, the actual exploit *and* solution came from Andrew. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-19 08:54:34
|
Hello I removed the logging from libgmail. It was used only two time and I replaced those by print statements. Libgmail should now run on Python >=3D 2.2 Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-19 07:06:45
|
On 9/19/05, Waseem S. Daher <wd...@mi...> wrote: > Yep, adding the [] fixed the first problem. Yep, but will result in a wrong dictionary containing the javascript values= . =20 > However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py > still dies: [....] > self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical > updated? > TypeError: unsubscriptable object Which results in this exception. See my former reply about the corupted version of your libgmail.py. > ------------------------------------ >=20 > Also worth noting is that on debian the logging package seems to be > broken in 2.2 > ------------------------------------ > wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py > Traceback (most recent call last): > File "libgmail.py", line 46, in ? > import logging > ImportError: No module named logging > ------------------------------------ Correct, logging was introduced in 2.3. I suggest to make libgmail depend on Python >=3D 2.3.=20 Python 2.2 is 2+ years old now. However we could make a test when importing the logging module and when it fails introduce a logging function that just prints the message. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Stas Z <sta...@gm...> - 2005-09-19 06:52:34
|
On 9/18/05, Waseem S. Daher <wd...@mi...> wrote: > Stas- >=20 > Thanks for all your hard work! > Right now when I run the latest CVS version, I get the following error: >=20 > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py > File "libgmail.py", line 93 > data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',', > ']']) > ^ > SyntaxError: invalid syntax I suspect that your copy of libgmail.py is corrupted. I assume that you cut and paste the above traceback. The correct line is: data =3D '\n'.join([x for x in lines if x and x[0] in ['D', ')', ',', ']']]= ) . ^^^ When I test it with Python2.3: stas@mobi:~/CVS-WORK/libgmail$ python2.3 libgmail.py Gmail account name: gatester1 Password:=20 Please wait, logging in... Login successful. 23 MB of 2608 MB used. (1%) Select folder or label to list: (Ctrl-C to exit) 0. inbox 1. starred 2. all 3. drafts 4. sent 5. spam Choice: 0 105ede6be44ce5b9 2 test mail 1045b58fffb35c40 1 test mail 105ede6be44ce5b9 2 Re: test mail ...... ...... Can you check your copy of libgmail.py? > Also, I uncommented a 'deal with multiline notes fields in contacts', > and that test does not yet pass for some reason. I'll try to investigate > further. I /have/ checked in this version of testlibgmail.py though. OK, but I suggest that we release libgmail as it is now *after* you check that you can run it on your Python2.3 system. Stas --=20 A nation that continues year after year to spend more money on military def= ense than on programs of social uplift is approaching spiritual doom. Martin Luther King, Jr. |
|
From: Andrew L. <one...@gm...> - 2005-09-19 04:02:08
|
Ah, indeed Sourceforge's CVS caught up. I'd love to look at that exception, but I haven't the time :-(. On 9/18/05, Waseem S. Daher <wd...@mi...> wrote: > Yep, adding the [] fixed the first problem. >=20 > However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py > still dies: > ------------------------------------ > wdaher@wdaher:~/Projects/libgmail$ python2.4 libgmail.py > Gmail account name: webmail.test > Password: >=20 > Please wait, logging in... > Login successful. >=20 > Traceback (most recent call last): > File "libgmail.py", line 1430, in ? > quotaInfo =3D ga.getQuotaInfo() > File "libgmail.py", line 456, in getQuotaInfo > self.getMessagesByFolder(U_INBOX_SEARCH) > File "libgmail.py", line 436, in getMessagesByFolder > return self._parseThreadSearch(folderName, allPages =3D allPages) > File "libgmail.py", line 412, in _parseThreadSearch > return GmailSearchResult(self, (searchType, kwargs), threadsInfo) > File "libgmail.py", line 1094, in __init__ > self._threads =3D [GmailThread(self, thread) for thread in > threadsInfo[0]] > File "libgmail.py", line 1182, in __init__ > self.id =3D threadsInfo[T_THREADID] # TODO: Change when canonical > updated? > TypeError: unsubscriptable object > ------------------------------------ >=20 > Also worth noting is that on debian the logging package seems to be > broken in 2.2 > ------------------------------------ > wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py > Traceback (most recent call last): > File "libgmail.py", line 46, in ? > import logging > ImportError: No module named logging > ------------------------------------ >=20 > The second issue is less of a concern for me than the first (which seems > to be a showstopper, at least on my machine...). >=20 > I'll try to take another look tomorrow, if I can finish my algorithms > homework :-P >=20 > As for the CVS version, what you're getting anonymously should be > exactly what we're getting, as far as I can tell. SourceForge's CVS lags > checkins by a few hours sometimes, though. >=20 > - W >=20 > On Sun, 2005-09-18 at 17:05 -0400, Andrew Lin wrote: > > I just checked; listcomps do in fact work in 2.2. > > > > On 9/18/05, Andrew Lin <one...@gm...> wrote: > > > Hm, I was wondering if you'd made the changes necessary to make it ru= n > > > in anything but 2.4. All of my machines have 2.4, so I've almost > > > forgotten what are 2.4 only features; of course, I'd assume that for > > > public consumption you guys want to stay compatible with 2.3 at the > > > least. > > > > > > The change you described can probably be done more easily by just > > > adding [] around the genexp. That should work in 2.3; I forget when > > > listcomps were added, but IIRC it should work in 2.2 as well. > > > > > > Also, where can I find the CVS version you refer to? I followed > > > sourceforge's directions for anonymous checkout of libgmail CVS, and > > > got (AFAICT) the same version as before. > > > > > > Andrew >=20 >=20 >=20 > ------------------------------------------------------- > SF.Net email is sponsored by: > Tame your development challenges with Apache's Geronimo App Server. > Download it for free - -and be entered to win a 42" plasma tv or your ver= y > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php > _______________________________________________ > Gmailagent-devel mailing list > Gma...@li... > https://lists.sourceforge.net/lists/listinfo/gmailagent-devel > |
|
From: Waseem S. D. <wd...@MI...> - 2005-09-19 01:00:43
|
Yep, adding the [] fixed the first problem.
However, with all version of python I have (2.2, 2.3, 2.4), libgmail.py
still dies:
------------------------------------
wdaher@wdaher:~/Projects/libgmail$ python2.4 libgmail.py
Gmail account name: webmail.test
Password:
Please wait, logging in...
Login successful.
Traceback (most recent call last):
File "libgmail.py", line 1430, in ?
quotaInfo = ga.getQuotaInfo()
File "libgmail.py", line 456, in getQuotaInfo
self.getMessagesByFolder(U_INBOX_SEARCH)
File "libgmail.py", line 436, in getMessagesByFolder
return self._parseThreadSearch(folderName, allPages = allPages)
File "libgmail.py", line 412, in _parseThreadSearch
return GmailSearchResult(self, (searchType, kwargs), threadsInfo)
File "libgmail.py", line 1094, in __init__
self._threads = [GmailThread(self, thread) for thread in
threadsInfo[0]]
File "libgmail.py", line 1182, in __init__
self.id = threadsInfo[T_THREADID] # TODO: Change when canonical
updated?
TypeError: unsubscriptable object
------------------------------------
Also worth noting is that on debian the logging package seems to be
broken in 2.2
------------------------------------
wdaher@wdaher:~/Projects/libgmail$ python2.2 libgmail.py
Traceback (most recent call last):
File "libgmail.py", line 46, in ?
import logging
ImportError: No module named logging
------------------------------------
The second issue is less of a concern for me than the first (which seems
to be a showstopper, at least on my machine...).
I'll try to take another look tomorrow, if I can finish my algorithms
homework :-P
As for the CVS version, what you're getting anonymously should be
exactly what we're getting, as far as I can tell. SourceForge's CVS lags
checkins by a few hours sometimes, though.
- W
On Sun, 2005-09-18 at 17:05 -0400, Andrew Lin wrote:
> I just checked; listcomps do in fact work in 2.2.
>
> On 9/18/05, Andrew Lin <one...@gm...> wrote:
> > Hm, I was wondering if you'd made the changes necessary to make it run
> > in anything but 2.4. All of my machines have 2.4, so I've almost
> > forgotten what are 2.4 only features; of course, I'd assume that for
> > public consumption you guys want to stay compatible with 2.3 at the
> > least.
> >
> > The change you described can probably be done more easily by just
> > adding [] around the genexp. That should work in 2.3; I forget when
> > listcomps were added, but IIRC it should work in 2.2 as well.
> >
> > Also, where can I find the CVS version you refer to? I followed
> > sourceforge's directions for anonymous checkout of libgmail CVS, and
> > got (AFAICT) the same version as before.
> >
> > Andrew
|
|
From: Andrew L. <one...@gm...> - 2005-09-18 21:05:42
|
I just checked; listcomps do in fact work in 2.2. On 9/18/05, Andrew Lin <one...@gm...> wrote: > Hm, I was wondering if you'd made the changes necessary to make it run > in anything but 2.4. All of my machines have 2.4, so I've almost > forgotten what are 2.4 only features; of course, I'd assume that for > public consumption you guys want to stay compatible with 2.3 at the > least. >=20 > The change you described can probably be done more easily by just > adding [] around the genexp. That should work in 2.3; I forget when > listcomps were added, but IIRC it should work in 2.2 as well. >=20 > Also, where can I find the CVS version you refer to? I followed > sourceforge's directions for anonymous checkout of libgmail CVS, and > got (AFAICT) the same version as before. >=20 > Andrew >=20 >=20 > On 9/18/05, Waseem S. Daher <wd...@mi...> wrote: > > Stas- > > > > Thanks for all your hard work! > > Right now when I run the latest CVS version, I get the following error: > > > > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python libgmail.py > > File "libgmail.py", line 93 > > data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ','= , > > ']']) > > ^ > > SyntaxError: invalid syntax > > > > wdaher@zygorthian-space-raiders:~/Projects/libgmail$ python -V > > Python 2.3.3 > > > > > > > > To try to fix this, I made the following change: > > - data =3D '\n'.join(x for x in lines if x and x[0] in ['D', ')', ',= ', > > ']']) > > + potential_data =3D [] > > + for x in lines: > > + if x and x[0] in ['D', ')', ',', ']']: > > + potential_data.append(x) > > + data =3D '\n'.join(potential_data) > > > > I have yet to check this into CVS though, because it's not totally doin= g > > the right thing -- when I run libgmail on its own after this fix, > > getQuota() doesn't work. > > > > I'll try to look into this more this evening. > > > > Also, I uncommented a 'deal with multiline notes fields in contacts', > > and that test does not yet pass for some reason. I'll try to investigat= e > > further. I /have/ checked in this version of testlibgmail.py though. > > > > In any case, thanks for all your hard work! > > > > - W > > > > > > On Sun, 2005-09-18 at 21:05 +0200, Stas Z wrote: > > > Gentleman, > > > > > > After spending the better part of my free Sunday hacking on the page = parser > > > in libgmail and ending up refactoring a major part of libgmail, I'm p= leased to > > > inform you that the work is done. > > > The new libgmail with the Andrew-parser is currently available in CVS= . > > > > > > Just as a reminder of why this is done. > > > Andrew reported a serious security bug in the page parser we used in = libgmail. > > > He already had created a different designed parser which doesn't have > > > these potential > > > bugs. Because the parser used in libgmail also had other problems > > > related to the frequent > > > changes in the javascript by Gmail, we decided to replace the parser > > > in libgmail. > > > > > > I've done the following tests: > > > testlibgmail.py > > > the test code in libgmail.py > > > the sendmessage.py demo > > > running libgmail in a python shell > > > > > > Of course it passed all these tests :-) > > > > > > I want to release it tomorrow, but I would really like that somebody > > > else test this > > > before that. > > > > > > Cheers, > > > Stas > > > > > > > > > ------------------------------------------------------- > > SF.Net email is sponsored by: > > Tame your development challenges with Apache's Geronimo App Server. > > Download it for free - -and be entered to win a 42" plasma tv or your v= ery > > own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.p= hp > > _______________________________________________ > > Gmailagent-devel mailing list > > Gma...@li... > > https://lists.sourceforge.net/lists/listinfo/gmailagent-devel > > > |
1 message has been excluded from this view by a project administrator.
