Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:sprattem
emacs-28.2
3c1693d0.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 3c1693d0.patch of Package emacs-28.2
From 3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulrich=20M=C3=BCller?= <ulm@gentoo.org> Date: Tue, 7 Mar 2023 18:25:37 +0100 Subject: Fix Elisp code injection vulnerability in emacsclient-mail.desktop A crafted mailto URI could contain unescaped double-quote characters, allowing injection of Elisp code. Therefore, any '\' and '"' characters are replaced by '\\' and '\"', using Bash pattern substitution (which is not available in the POSIX shell). We want to pass literal 'u=${1//\\/\\\\}; u=${u//\"/\\\"};' in the bash -c command, but in the desktop entry '"', '$', and '\' must be escaped as '\\"', '\\$', and '\\\\', respectively (backslashes are expanded twice, see the Desktop Entry Specification). Reported by Gabriel Corona <gabriel.corona@free.fr>. * etc/emacsclient-mail.desktop (Exec): Escape backslash and double-quote characters. --- etc/emacsclient-mail.desktop | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/emacsclient-mail.desktop b/etc/emacsclient-mail.desktop index 91df122..49c6f99 100644 --- a/etc/emacsclient-mail.desktop +++ b/etc/emacsclient-mail.desktop @@ -1,7 +1,10 @@ [Desktop Entry] Categories=Network;Email; Comment=GNU Emacs is an extensible, customizable text editor - and more -Exec=sh -c "exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u +# We want to pass the following commands to the shell wrapper: +# u=${1//\\/\\\\}; u=${u//\"/\\\"}; exec emacsclient --alternate-editor= --display="$DISPLAY" --eval "(message-mailto \"$u\")" +# Special chars '"', '$', and '\' must be escaped as '\\"', '\\$', and '\\\\'. +Exec=bash -c "u=\\${1//\\\\\\\\/\\\\\\\\\\\\\\\\}; u=\\${u//\\\\\\"/\\\\\\\\\\\\\\"}; exec emacsclient --alternate-editor= --display=\\"\\$DISPLAY\\" --eval \\"(message-mailto \\\\\\"\\$u\\\\\\")\\"" bash %u Icon=emacs Name=Emacs (Mail, Client) MimeType=x-scheme-handler/mailto; @@ -13,7 +16,7 @@ Actions=new-window;new-instance; [Desktop Action new-window] Name=New Window -Exec=sh -c "exec emacsclient --alternate-editor= --create-frame --eval \\"(message-mailto \\\\\\"\\$1\\\\\\")\\"" sh %u +Exec=bash -c "u=\\${1//\\\\\\\\/\\\\\\\\\\\\\\\\}; u=\\${u//\\\\\\"/\\\\\\\\\\\\\\"}; exec emacsclient --alternate-editor= --create-frame --eval \\"(message-mailto \\\\\\"\\$u\\\\\\")\\"" bash %u [Desktop Action new-instance] Name=New Instance -- cgit v1.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor