Prevent command injection in attachment
Merge branch 'safe-mime-decode-hook' into develop