Handle unencoded equals in quoted printable sanitizer

part.go

@@ -86,7 +86,7 @@ func (p *Part) buildContentReaders(r io.Reader) error {
 	encoding := p.Header.Get(hnContentEncoding)
 	switch strings.ToLower(encoding) {
 	case "quoted-printable":
-		contentReader = newQPCleaner(contentReader.(io.ByteReader))
+		contentReader = newQPCleaner(contentReader)
 		contentReader = quotedprintable.NewReader(contentReader)
 	case "base64":
 		contentReader = newBase64Cleaner(contentReader)

quotedprint.go

@@ -1,24 +1,25 @@
 package enmime
 
 import (
+	"bufio"
 	"fmt"
 	"io"
 )
 
 // qpCleaner scans quoted printable content for invalid characters and encodes them so that
 // Go's quoted-printable decoder does not abort with an error.
 type qpCleaner struct {
-	in io.ByteReader
+	in *bufio.Reader
 }
 
 // Assert qpCleaner implements io.Reader
 var _ io.Reader = &qpCleaner{}
 
 // newBase64Cleaner returns a Base64Cleaner object for the specified reader.  Base64Cleaner
 // implements the io.Reader interface.
-func newQPCleaner(r io.ByteReader) *qpCleaner {
+func newQPCleaner(r io.Reader) *qpCleaner {
 	return &qpCleaner{
-		in: r,
+		in: bufio.NewReader(r),
 	}
 }
 
@@ -34,6 +35,19 @@ func (qp *qpCleaner) Read(dest []byte) (n int, err error) {
 		}
 		// Test character type
 		switch {
+		case b == '=':
+			// pass valid hex bytes through
+			hexBytes, err := qp.in.Peek(2)
+			if err != nil && err != io.EOF {
+				return 0, err
+			}
+			if isValidHexBytes(hexBytes) {
+				dest[n] = b
+				n++
+			} else {
+				s := fmt.Sprintf("=%02X", b)
+				n += copy(dest[n:], s)
+			}
 		case b == '\t' || b == '\r' || b == '\n':
 			// Valid special characters
 			dest[n] = b
@@ -50,3 +64,42 @@ func (qp *qpCleaner) Read(dest []byte) (n int, err error) {
 	}
 	return
 }
+
+func isValidHexByte(b byte) bool {
+	switch {
+	case b >= '0' && b <= '9':
+		return true
+	case b >= 'A' && b <= 'F':
+		return true
+	// Accept badly encoded bytes.
+	case b >= 'a' && b <= 'f':
+		return true
+	}
+	return false
+}
+
+func isValidHexBytes(v []byte) bool {
+	if len(v) < 1 {
+		return false
+	}
+
+	// soft line break
+	if v[0] == '\n' {
+		return true
+	}
+
+	if len(v) < 2 {
+		return false
+	}
+
+	// soft line break
+	if v[0] == '\r' && v[1] == '\n' {
+		return true
+	}
+
+	if isValidHexByte(v[0]) && isValidHexByte(v[1]) {
+		return true
+	}
+
+	return false
+}

quotedprint_test.go

@@ -2,6 +2,7 @@ package enmime
 
 import (
 	"bytes"
+	"errors"
 	"io"
 	"strings"
 	"testing"
@@ -19,6 +20,8 @@ func TestQPCleaner(t *testing.T) {
 		{"\r\n\t", "\r\n\t"},
 		{"pédagogues", "p=C3=A9dagogues"},
 		{"Stuffs’s", "Stuffs=E2=80=99s"},
+		{"=", "=3D"},
+		{"=a", "=3Da"},
 	}
 
 	for _, tc := range ttable {
@@ -63,6 +66,24 @@ func TestQPCleanerOverflow(t *testing.T) {
 	}
 }
 
+var PEEK_ERR = errors.New("DIE BART DIE")
+
+type peekBreakReader string
+
+func (r peekBreakReader) Read(p []byte) (int, error) {
+	return copy(p, r), PEEK_ERR
+}
+
+func TestQPPeekError(t *testing.T) {
+	qp := newQPCleaner(peekBreakReader("=a"))
+
+	buf := make([]byte, 100)
+	_, err := qp.Read(buf)
+	if err != PEEK_ERR {
+		t.Errorf("Got: %q, want: %q", err, PEEK_ERR)
+	}
+}
+
 var result int
 
 func BenchmarkQPCleaner(b *testing.B) {

testdata/parts/quoted-printable-invalid.raw

@@ -2,6 +2,8 @@ Content-Type: text/plain; charset="utf-8"
 Content-Transfer-Encoding: quoted-printable
 Content-Disposition: inline
 
+https://www.amazon.ca/gp/product/B002M8EEW8/ref=od_aui_detailpages00?ie=UTF8&psc=1
+
 Stuffs’s Weekly Summary
 Sunday, January 15th – Saturday, January 21st