From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#28350: enriched.el code execution Date: Sun, 10 Sep 2017 20:01:20 +0300 Message-ID: <83y3pmtrmn.fsf@gnu.org> References: <837exb1bk5.fsf@gnu.org> <838thovvcr.fsf@gnu.org> <83wp57vmk6.fsf@gnu.org> Reply-To: Eli Zaretskii NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1505062955 28497 195.159.176.226 (10 Sep 2017 17:02:35 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sun, 10 Sep 2017 17:02:35 +0000 (UTC) Cc: 28350@debbugs.gnu.org To: charles@aurox.ch (Charles A. Roelli) Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Sep 10 19:02:31 2017 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dr5cW-00069j-JD for geb-bug-gnu-emacs@m.gmane.org; Sun, 10 Sep 2017 19:02:08 +0200 Original-Received: from localhost ([::1]:53658 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dr5cd-0000Ci-O4 for geb-bug-gnu-emacs@m.gmane.org; Sun, 10 Sep 2017 13:02:15 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:51797) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dr5cT-00009b-Di for bug-gnu-emacs@gnu.org; Sun, 10 Sep 2017 13:02:06 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dr5cQ-0003WQ-Bp for bug-gnu-emacs@gnu.org; Sun, 10 Sep 2017 13:02:05 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:50894) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dr5cQ-0003WI-8G for bug-gnu-emacs@gnu.org; Sun, 10 Sep 2017 13:02:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1dr5cQ-000495-0n for bug-gnu-emacs@gnu.org; Sun, 10 Sep 2017 13:02:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 10 Sep 2017 17:02:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28350 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 28350-submit@debbugs.gnu.org id=B28350.150506288415891 (code B ref 28350); Sun, 10 Sep 2017 17:02:01 +0000 Original-Received: (at 28350) by debbugs.gnu.org; 10 Sep 2017 17:01:24 +0000 Original-Received: from localhost ([127.0.0.1]:59575 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dr5bo-00048E-Fs for submit@debbugs.gnu.org; Sun, 10 Sep 2017 13:01:24 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:60261) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dr5bm-000481-Ha for 28350@debbugs.gnu.org; Sun, 10 Sep 2017 13:01:22 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dr5be-00037M-7C for 28350@debbugs.gnu.org; Sun, 10 Sep 2017 13:01:17 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:36511) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dr5be-00037H-3A; Sun, 10 Sep 2017 13:01:14 -0400 Original-Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:3492 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1dr5bc-00021n-SX; Sun, 10 Sep 2017 13:01:13 -0400 In-reply-to: (charles@aurox.ch) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:136732 Archived-At: > Date: Sat, 09 Sep 2017 22:37:29 +0200 > From: charles@aurox.ch (Charles A. Roelli) > CC: 28350@debbugs.gnu.org > > Thank you. I've kept the current approach. Please see again the > attached patch. Some minor nits below. > Also, should the left-fringe/right-fringe display specifications be > considered safe? They seem innocuous. Yes, I think so. And your patch already does allow them, doesn't it? > +(defcustom enriched-allow-unsafe-display-props nil > + "Variable determining whether to decode arbitrary display properties. "If non-nil allow to evaluate arbitrary forms in display properties." > + :risky t > + :type 'boolean > + :group 'enriched) Please add :version here. Please also add a short NEWS entry. It would be good to have tests for this, but doing that is much less urgent than fixing the vulnerability, so please feel free to do so as a separate commit (unless you already have the tests ready). Otherwise, looks good to me. Thanks.