From 6b2311663bafe69466dbc1fd93000a565303c6b1 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Wed, 2 Feb 2022 18:43:55 +0100
Subject: [PATCH] #89 Hide PGP SIGNATURE from cleartext signed messages

---
 dev/Common/Html.js   |  4 +++-
 dev/Model/Message.js | 10 +++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/dev/Common/Html.js b/dev/Common/Html.js
index 56afe8e84..4cbe5b29a 100644
--- a/dev/Common/Html.js
+++ b/dev/Common/Html.js
@@ -193,7 +193,9 @@ export const
 			}
 
 			if (oElement.hasAttribute('href')) {
-				let sHref = getAttribute('href');
+				let sHref = getAttribute('href')
+					// Strip utm_* tracking
+					.replace(/(\?|&)utm_[a-z]+=[^&?#]*/si, '$1');
 				if (!/^([a-z]+):/i.test(sHref) && '//' !== sHref.slice(0, 2)) {
 					oElement.setAttribute('data-x-broken-href', sHref);
 					oElement.removeAttribute('href');
diff --git a/dev/Model/Message.js b/dev/Model/Message.js
index 8e847d0b0..b8858cdb7 100644
--- a/dev/Model/Message.js
+++ b/dev/Model/Message.js
@@ -461,12 +461,16 @@ export class MessageModel extends AbstractModel {
 		if (body && this.plain()) {
 			body.classList.toggle('html', 0);
 			body.classList.toggle('plain', 1);
-			body.innerHTML = plainToHtml(this.plain())
+			body.innerHTML = plainToHtml(
+				this.plain()
+					.replace(/-----BEGIN PGP SIGNATURE-----[\s\S]*/, '')
+					.replace(/-----BEGIN PGP SIGNED MESSAGE-----(\r?\n[a-z][^\r\n]+)+/i, '')
+					.trim()
+			)
 				// Strip utm_* tracking
-				.replace(/(\\?|&amp;|&)utm_[a-z]+=[a-z0-9_-]*/si, '$1')
+				.replace(/(\?|&amp;|&)utm_[a-z]+=[^?&#]*/si, '$1')
 				.replace(url, '$1<a href="$2" target="_blank">$2</a>')
 				.replace(email, '$1<a href="mailto:$2">$2</a>');
-
 			this.isHtml(false);
 			this.hasImages(false);
 			this.initView();