[Patch v5 3/4] emacs: check drafts for encryption tags before saving

[David Bremner]

In general the user may not want to save plaintext copies of messages
that they are sending encrypted, so give them a chance to abort.
---
 emacs/notmuch-draft.el   | 40 ++++++++++++++++++++++++++++++++++++++++
 test/T630-emacs-draft.sh | 13 +++++++++++++
 2 files changed, 53 insertions(+)

diff --git a/emacs/notmuch-draft.el b/emacs/notmuch-draft.el
index 11d906b..5a230e8 100644
--- a/emacs/notmuch-draft.el
+++ b/emacs/notmuch-draft.el
@@ -70,6 +70,21 @@ postponing and resuming a message."
   :type '(repeat string)
   :group 'notmuch-send)
 
+(defcustom notmuch-draft-save-plaintext 'ask
+  "Should notmuch save/postpone in plaintext messages that seem
+  like they are intended to be sent encrypted
+(i.e with an mml encryption tag in it)."
+  :type '(radio
+	  (const :tag "Never" nil)
+	  (const :tag "Ask every time" ask)
+	  (const :tag "Always" t))
+  :group 'notmuch-draft
+  :group 'notmuch-crypto)
+
+(defvar notmuch-draft-encryption-tag-regex
+  "<#\\(part encrypt\\|secure.*mode=.*encrypt>\\)"
+  "Regular expression matching mml tags indicating encryption of part or message")
+
 (defvar notmuch-draft-id nil
   "Message-id of the most recent saved draft of this message")
 (make-variable-buffer-local 'notmuch-draft-id)
@@ -102,6 +117,22 @@ Used when a new version is saved, or the message is sent."
 	  (goto-char (+ (match-beginning 0) 2))
 	  (insert "!"))))))
 
+(defun notmuch-draft--check-encryption-tag (&optional ask)
+  "Query user if there an mml tag that looks like it might indicate encryption.
+
+Returns t if there is no such tag, or the user confirms they mean
+it."
+  (save-excursion
+    (message-goto-body)
+      (or
+       ;; We are fine if no relevant tag is found, or
+       (not (re-search-forward notmuch-draft-encryption-tag-regex nil 't))
+       ;; The user confirms they means it.
+       (and ask
+	    (yes-or-no-p "(Customize `notmuch-draft-save-plaintext' to avoid this warning)
+This message contains mml tags that suggest it is intended to be encrypted.
+Really save and index an unencrypted copy? ")))))
+
 (defun notmuch-draft-save ()
   "Save the current draft message in the notmuch database.
 
@@ -109,6 +140,15 @@ This saves the current message in the database with tags
 `notmuch-draft-tags` (in addition to any default tags
 applied to newly inserted messages)."
   (interactive)
+  (case notmuch-draft-save-plaintext
+    ((ask)
+     (unless (notmuch-draft--check-encryption-tag t)
+       (error "Save aborted")))
+    ((t)
+     (ignore))
+    ((nil)
+     (unless (notmuch-draft--check-encryption-tag nil)
+       (error "Refusing to save draft with encryption tags (see `notmuch-draft-save-plaintext')"))))
   (let (;; We need the message id as we need it for tagging. Note
 	;; message-make-message-id gives the id inside a "<" ">" pair,
 	;; but notmuch doesn't want that form, so remove them.
diff --git a/test/T630-emacs-draft.sh b/test/T630-emacs-draft.sh
index e39690c..689ccfb 100755
--- a/test/T630-emacs-draft.sh
+++ b/test/T630-emacs-draft.sh
@@ -39,4 +39,17 @@ header_count=$(notmuch show --format=raw subject:draft-test-0003 | grep -c ^X-No
 body_count=$(notmuch notmuch show --format=raw subject:draft-test-0003 | grep -c '^\<#secure')
 test_expect_equal "$header_count,$body_count" "1,0"
 
+test_begin_subtest "Refusing to save an encrypted draft"
+test_emacs '(notmuch-mua-mail)
+	    (message-goto-subject)
+	    (insert "draft-test-0004")
+	    (mml-secure-message-sign-encrypt)
+	    (let ((notmuch-draft-save-plaintext nil))
+		     (notmuch-draft-save))
+	    (test-output)'
+count1=$(notmuch count tag:draft)
+count2=$(notmuch count subject:draft-test-0004)
+
+test_expect_equal "$count1,$count2" "3,0"
+
 test_done
-- 
2.10.2