From: Eli Zaretskii <eliz@gnu.org>
To: Maxim Nikulin <m.a.nikulin@gmail.com>
Cc: 66390@debbugs.gnu.org
Subject: bug#66390: `man' allows to inject arbitrary shell code
Date: Sat, 07 Oct 2023 16:04:17 +0300 [thread overview]
Message-ID: <83wmvyzir2.fsf@gnu.org> (raw)
In-Reply-To: <f17b9b73-8927-446a-9e54-459aad3b7bee@gmail.com> (message from Maxim Nikulin on Sat, 7 Oct 2023 19:47:04 +0700)
> From: Maxim Nikulin <m.a.nikulin@gmail.com>
> Date: Sat, 7 Oct 2023 19:47:04 +0700
>
> man.el does not escape properly shell special characters when `man' is
> invoked with an argument to open particular manual page. As a result
> arbitrary shell code may be executed.
>
> I do not consider it as a real issue when the `man' command is invoked
> by a user directly. However it is a security vulnerability when other
> packages calls `man' to open a specific page.
>
> Consider an Org mode document with the following link and ol-man is loaded
>
> <man:File:\:UserDirs(3pm)>
>
> In response to C-c C-o (`org-open-at-point') an error appears instead of
> formatted manual page
>
> --- 8< ---
> /usr/bin/sh: 1: Syntax error: "(" unexpected
>
> process exited abnormally with code 2
> --- >8 ---
>
> Alternatively just evaluate
>
> (man "File:\\:UserDirs(3pm)")
Why isn't it a problem with the command that invokes 'man', in this
case Org?
> man.el should prevent substitution of shell specials literally from
> `man' arguments into shell commands.
I think callers of 'man' should prevent that instead.
next prev parent reply other threads:[~2023-10-07 13:04 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-07 12:47 bug#66390: `man' allows to inject arbitrary shell code Maxim Nikulin
2023-10-07 13:04 ` Eli Zaretskii [this message]
2023-10-07 14:12 ` Max Nikulin
2023-10-07 14:19 ` Eli Zaretskii
2023-10-07 14:29 ` Max Nikulin
2023-10-07 15:10 ` Eli Zaretskii
2023-10-07 15:37 ` Michael Albinus
2023-10-07 15:58 ` Eli Zaretskii
2023-10-07 16:55 ` Michael Albinus
2023-10-07 17:24 ` Eli Zaretskii
2023-10-07 17:45 ` Michael Albinus
2023-10-07 18:26 ` Eli Zaretskii
2023-10-08 3:37 ` Max Nikulin
2023-10-08 5:28 ` Eli Zaretskii
2023-10-09 15:12 ` Max Nikulin
2023-10-09 15:52 ` Eli Zaretskii
2023-10-09 16:30 ` lux
2023-10-09 16:48 ` Eli Zaretskii
2023-10-09 17:07 ` Ihor Radchenko
2023-10-09 17:20 ` Andreas Schwab
2023-10-10 2:47 ` lux
2023-10-10 7:43 ` Stefan Kangas
2023-10-10 12:11 ` Eli Zaretskii
2023-10-10 12:25 ` Stefan Kangas
2023-10-10 11:09 ` Max Nikulin
2023-10-10 10:54 ` Max Nikulin
2023-10-10 14:30 ` lux
2023-10-10 16:21 ` Andreas Schwab
2023-10-11 3:08 ` lux
2023-10-11 10:46 ` Max Nikulin
2023-10-20 21:00 ` Stefan Kangas
2023-10-21 7:19 ` Eli Zaretskii
2023-10-21 7:35 ` Andreas Schwab
2023-10-21 7:45 ` Eli Zaretskii
2023-10-21 9:19 ` Stefan Kangas
2024-01-10 21:21 ` Stefan Kangas
2024-01-11 12:07 ` Ihor Radchenko
2024-01-11 14:34 ` Max Nikulin
2024-01-11 15:07 ` Ihor Radchenko
2024-01-11 15:28 ` Eli Zaretskii
2024-01-11 15:37 ` Ihor Radchenko
2023-10-09 2:36 ` Richard Stallman
2023-10-09 11:04 ` Eli Zaretskii
2023-10-10 11:56 ` Richard Stallman
2023-10-11 10:56 ` Max Nikulin
2023-10-08 3:42 ` Maxim Nikulin
2023-10-08 5:20 ` Eli Zaretskii
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=83wmvyzir2.fsf@gnu.org \
--to=eliz@gnu.org \
--cc=66390@debbugs.gnu.org \
--cc=m.a.nikulin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).