[Bug 295785] mail/dovecot: package message potentially misleading (re: decode2text)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295785

            Bug ID: 295785
           Summary: mail/dovecot: package message potentially misleading
                    (re: decode2text)
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: Individual Port(s)
          Assignee: ler@FreeBSD.org
          Reporter: bob@vesterman.com
             Flags: maintainer-feedback?(ler@FreeBSD.org)
          Assignee: ler@FreeBSD.org

I've been looking into installing Dovecot, and noticed this in the package
message:

"If you want to be able to search within attachments using the decode2text
plugin, you'll need to install textproc/catdoc, and one of graphics/xpdf or
graphics/poppler-utils."

Well, sure, I guess I'd like to be able to search within attachments. I don't
know anything about this decode2text thing or anything else to enable this, so
I tried looking up information about it.

I haven't really found much, but what I have is not exactly filling me with
confidence.

The top hit from my simple search for "decode2text" is a file named
"decode2text.sh" within some GitHub repository:

https://github.com/bdraco/dovecot/blob/master/src/plugins/fts/decode2text.sh

The repository is named "dovecot"; cool, cool, I guess, but: "This repository
was archived by the owner on Oct 15, 2022. It is now read-only."

Moreover, "the owner" here is not the GitHub user named on Dovecot's website
(i.e. the user "dovecot"). Moreover, that user's Dovecot repository contains no
such file, nor any other file matching "decode2txt". I am guessing it once had
such a file, but it has been removed.

Looking further: The next search hit has nothing to do with Dovecot. Then the
third is a link to a page about full text searching on Dovecot's website:

https://doc.dovecot.org/2.4.2/core/plugins/fts.html

That got my hopes up a bit, but it says "See the decode2text.sh script included
in Dovecot for how to use this." As noted earlier, there is no decode2text.sh
script in the repository, so I'm guessing this FTS page's text just hasn't been
updated appropriately.

Next hit is CVE about decode2text:

https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html#cve-2025-59031-decode2text-sh-ooxml-extraction-may-follow-symlinks-and-read-unintended-files-during-indexing

Apparently it "unsafely handles zip-style attachments". Remediation? "Do not
use the provided script, instead, use something else like FTS tika."

So it seems like this part of the package message might be at best out-of-date,
at least potentially misleading the user into wasting time on a hunt like it
just did to me, and quite possibly dangerous. Maybe it should be changed?

-- 
You are receiving this mail because:
You are the assignee for the bug.