From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Spencer Baugh Newsgroups: gmane.emacs.bugs Subject: bug#65902: 29.0.92; emacsclient-mail.desktop fails due to complicated escaping Date: Wed, 13 Sep 2023 11:23:06 -0400 Message-ID: References: <83ttrym8jx.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="10649"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Gnus/5.13 (Gnus v5.13) Cc: Spencer Baugh , 65902@debbugs.gnu.org To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Wed Sep 13 17:24:21 2023 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qgRj0-0002YM-Vc for geb-bug-gnu-emacs@m.gmane-mx.org; Wed, 13 Sep 2023 17:24:18 +0200 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qgRig-0006E2-Hl; Wed, 13 Sep 2023 11:23:58 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qgRif-0006Dd-7R for bug-gnu-emacs@gnu.org; Wed, 13 Sep 2023 11:23:57 -0400 Original-Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qgRie-0000xk-Vj for bug-gnu-emacs@gnu.org; Wed, 13 Sep 2023 11:23:56 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1qgRik-0005f8-7G for bug-gnu-emacs@gnu.org; Wed, 13 Sep 2023 11:24:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Spencer Baugh Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 13 Sep 2023 15:24:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 65902 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 65902-submit@debbugs.gnu.org id=B65902.169461860221696 (code B ref 65902); Wed, 13 Sep 2023 15:24:02 +0000 Original-Received: (at 65902) by debbugs.gnu.org; 13 Sep 2023 15:23:22 +0000 Original-Received: from localhost ([127.0.0.1]:35665 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qgRi6-0005ds-8y for submit@debbugs.gnu.org; Wed, 13 Sep 2023 11:23:22 -0400 Original-Received: from mxout5.mail.janestreet.com ([64.215.233.18]:55893) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1qgRi2-0005dc-0z for 65902@debbugs.gnu.org; Wed, 13 Sep 2023 11:23:21 -0400 In-Reply-To: <83ttrym8jx.fsf@gnu.org> (Eli Zaretskii's message of "Wed, 13 Sep 2023 17:50:26 +0300") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:270316 Archived-At: Eli Zaretskii writes: >> Date: Wed, 13 Sep 2023 14:08:01 +0000 (UTC) >> From: Spencer Baugh >> Cc: 65902@debbugs.gnu.org >> >> On Sep 13, 2023 09:26, Eli Zaretskii wrote: >> >> > I am not sure what you're suggesting. Can you show how the equivalent >> > of: >> > >> > emacsclient --apply message-mailto -- %u >> > >> > would work with that design? >> >> emacsclient --qeval '(message-mailto %u)' >> >> I don't think this can work in general for arbitrary user input: what if %u is replaced with something >> that contains parentheses? > > They are inside '..', so the only one who'd care is Emacs, not the > shell. Agreed. The problem I'm referring to is in Emacs, interpreting arbitrary input from the web as code. (The .desktop commands don't even use a shell, a shell doesn't need to be involved at any point) > In which case it's the job of whoever provides the value for > %u to handle that. The value for %u is an arbitrary string from some other application which wants to open a mailto: URI, and passes it to xdg-open which then passes it to Emacs. Other applications are not aware of what escaping is needed to make Emacs not interpret it as code. And indeed, there's no point in doing that: Emacs is in the best position to do that escaping, if it needs to be done. > And anyway, how is that different from the same problem happening with > your suggested --funcall or --apply? they will bump into the same > issues. No, they won't: --apply passes the arguments as a string, without ever trying to parse them as Lisp. Let's be concrete: imagine %u is replaced with (shell-command "rm -r /") as could happen if an application receives some malicious input. The command line with --qeval is: emacsclient --qeval '(message-mailto (shell-command "rm -r /"))' Emacs receives -eval (message-mailto (shell-command "rm -r /")) and evals (message-mailto (shell-command "rm -r /")) and deletes your files. The command line with --apply is: emacsclient --apply message-mailto '(shell-command "rm -r /")' Emacs receives -apply message-mailto --applyarg (shell-command "rm -r /") and evals (message-mailto "(shell-command \"rm -r /\")") and nothing bad happens. Emacs just needs to get the verbatim string without trying to parse it as Lisp at any point. This is an extremely standard security technique when dealing with malicious input, which is why the previous thread converged on it so quickly. >> Let's not do that this time, okay? >> >> Agreed, I think we reached a consensus in that bug and now I am implementing that consensus. > > AFAIU, there was no consensus reached there, so I'm unsure what are > you alluding to here. Everyone in that thread agreed that something like this --apply design (which passes the strings verbatim to Emacs without evaling them) is what we need, they were just discussing the exact design, and in the end the design that everyone who posted agreed on, matched what I have implemented... I don't think we need to relitigate it.