unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
* bug#16984: dired-do-rename susceptible to .../~/... hijack
@ 2014-03-10 18:10 積丹尼 Dan Jacobson
  2016-10-23  2:21 ` npostavs
  0 siblings, 1 reply; 23+ messages in thread
From: 積丹尼 Dan Jacobson @ 2014-03-10 18:10 UTC (permalink / raw)
  To: 16984

R runs the command dired-do-rename, which is an interactive autoloaded
compiled Lisp function in `dired-aux.el'.

Using it, I got this strange error:

Move `/home/jidanni/.cpanm/work/1327389327.6650' to `/tmp/1327389327.6650' failed:
(file-error Opening output file permission denied /home/jidanni/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01/MYMETA.json)

Well it turns out emacs' file name simplifying rules are being applied
in inappropriate places like when encountering

  /home/jidanni/.cpanm/work/1327389327.6650/accessors-1.01/~/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01:
  total 16
  drwxr-xr-x 2 jidanni 4096 2012-01-24  .
  drwxr-xr-x 3 jidanni 4096 2012-01-24  ..
  -r--r--r-- 1 jidanni 1374 2012-01-24  MYMETA.json
  -r--r--r-- 1 jidanni  456 2012-01-24  install.json

One must use /bin/mv and not dired-do-rename to get the job done right.

One can even think of ways the bad guys could exploit this to chip away
at arbitrary files.

$ apt-cache policy emacs-snapshot
emacs-snapshot:
  Installed: 2:20140101-1





^ permalink raw reply	[flat|nested] 23+ messages in thread

end of thread, other threads:[~2016-12-12  2:57 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-03-10 18:10 bug#16984: dired-do-rename susceptible to .../~/... hijack 積丹尼 Dan Jacobson
2016-10-23  2:21 ` npostavs
2016-10-23  6:50   ` Eli Zaretskii
2016-10-29  2:27     ` npostavs
2016-10-29  7:01       ` Eli Zaretskii
2016-10-29 13:23         ` Michael Albinus
2016-10-29 15:54           ` npostavs
2016-10-29 16:22             ` Michael Albinus
2016-11-01  0:42               ` npostavs
2016-12-04 19:06                 ` Michael Albinus
2016-12-08  1:47                   ` npostavs
2016-12-08  8:23                     ` Michael Albinus
2016-12-08 14:39                       ` npostavs
2016-12-08 14:58                         ` Michael Albinus
2016-12-08 17:03                           ` Michael Albinus
2016-12-08 16:00                         ` Eli Zaretskii
2016-12-09  4:56                           ` npostavs
2016-12-09  8:05                             ` Michael Albinus
2016-12-12  2:57                               ` npostavs
2016-12-09  8:19                             ` Eli Zaretskii
2016-12-08 15:58                       ` Eli Zaretskii
2016-12-08 16:25                         ` Michael Albinus
2016-12-08 17:23                           ` Eli Zaretskii

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).