Add security warning to mailbox docs

[StanFromIreland]

CC @bitdancer, you should have gotten a series of notifications just there. I suggest adding a security warning, they collectively are the motivation for this change.

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #34088510 | 📁 Comparing 599ed1a against main (3a1df78)

  🔍 Preview build  

10 files changed · ± 10 modified

± Modified

• c-api/perfmaps.html
• deprecations/index.html
• deprecations/pending-removal-in-3.20.html
• library/ast.html
• library/mailbox.html
• whatsnew/3.12.html
• whatsnew/3.13.html
• whatsnew/3.14.html
• whatsnew/3.15.html
• whatsnew/changelog.html

[bedevere-app]

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

[StanFromIreland]

I'll defer to RDM, closing.

[StanFromIreland]

I have made the requested changes; please review again

I slightly modified your suggestion @bitdancer to smooth it out a little and to use the standard terminology.

[bedevere-app]

Thanks for making the requested changes!

@bitdancer: please review the changes made to this pull request.

[StanFromIreland]

Friendly little ping @bitdancer, I'd like to clear up our backlog a little. :-)

[serhiy-storchaka]

This warning is too loud (I think a note or even a plain text would be enough), and too vague.v What "all inputs are provided by the local user" does mean? That you cannot use it to read emails sent by non-local users? That you cannot open a mailbox created on other computer? This is obviously not so, otherwise this module would be useless. What "the underlying mailbox storage is accessible only to that user" does mean? I think that you can safely concurrently read a mailbox, until it is not concurrently modified. Then you have the same limitations as for any shared file.

I know this is to answer the security report, but the surface of thet report was not clear.

[StanFromIreland]

This warning is too loud

Every other security warning is in a .. warning:: box, because it's important for users to know.

What "all inputs are provided by the local user" does mean?

The user choses where mailboxes are created, what emails are added, removed etc. If someone else has access to the application and can do so we don't consider it a mailbox vulnerability.

What "the underlying mailbox storage is accessible only to that user" does mean?

The user is the only person with access to the mailbox. If someone else can it or its contents it we don't consider it a mailbox vulnerability.

@serhiy-storchaka, I'm afraid I don't quite see how to improve this without turning it into an essay. Maybe you have a suggestion?

[bitdancer]

Hmm. Would it be clearer if we said "data from untrusted sources is never passed to the module API calls"? And perhaps "only trusted users have access to the filesystems accessible to the module"? That doesn't quite capture the problem, though. Can we talk about the file system trust boundary being the responsibility of the hosting environment? That's seems pretty opaque to a non-security professional, though (assuming I even worded it right, since I'm not one ;)

I'd be happier if it wasn't a warning box, but I think I lost that argument already ;)

[StanFromIreland]

Sorry for the delay, this slipped of my list. I've applied your suggestion @bitdancer.