From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: "lux" Newsgroups: gmane.emacs.bugs Subject: bug#59817: [PATCH] Fix etags local command injection vulnerability Date: Mon, 5 Dec 2022 08:58:13 +0800 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_638D4225_0FED55A0_1F60518E" Content-Transfer-Encoding: 8Bit Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="20944"; mail-complaints-to="usenet@ciao.gmane.io" Cc: 59817 <59817@debbugs.gnu.org> To: "Eli Zaretskii" Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Mon Dec 05 01:59:15 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1p1zpC-0005Gh-RZ for geb-bug-gnu-emacs@m.gmane-mx.org; Mon, 05 Dec 2022 01:59:15 +0100 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1p1zp2-0003eJ-50; Sun, 04 Dec 2022 19:59:04 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p1zp0-0003e4-8M for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 19:59:02 -0500 Original-Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1p1zoz-0001gz-VB for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 19:59:01 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1p1zoz-0005Nz-Qi for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 19:59:01 -0500 X-Loop: help-debbugs@gnu.org In-Reply-To: Resent-From: "lux" Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Mon, 05 Dec 2022 00:59:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 59817 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 59817-submit@debbugs.gnu.org id=B59817.167020190720694 (code B ref 59817); Mon, 05 Dec 2022 00:59:01 +0000 Original-Received: (at 59817) by debbugs.gnu.org; 5 Dec 2022 00:58:27 +0000 Original-Received: from localhost ([127.0.0.1]:60787 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1p1zoR-0005Ni-2D for submit@debbugs.gnu.org; Sun, 04 Dec 2022 19:58:27 -0500 Original-Received: from out162-62-58-211.mail.qq.com ([162.62.58.211]:52811) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1p1zoN-0005Nc-FO for 59817@debbugs.gnu.org; Sun, 04 Dec 2022 19:58:25 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1670201893; bh=hRUlPaoVfgQmh43ZcXq70ajlpFfGBTEikZ476nDautM=; h=From:To:Cc:Subject:Date; b=dd0dDURMHQz4OEZ/FfD/lkJXiJgLuroOVUzxvs/JZqmcGweegP88bqcrCrKEciW5r g3d8kcUmBQDKsCOf7eF/dH5eFNLGgyVvO0L6wPuKUAr5BZHm1c3CaYIBx/HspDbfwe Ic6avu4obwDGBaCskxCH/z2ftZ1BAOl3TTbddfXU= X-QQ-FEAT: oHWrrGTW1dAz+QFKvuUnj/W0ULeT1nZf X-QQ-SSF: 00000000000000F0000000000000 X-QQ-XMAILINFO: MvBKtgduchMIV9f6xNE8lulJlfqynqlGGCbbsrCReMo80c/tVxY+w4ZE2TKibz F7ODM8/q7tsjkuG4sOavfozzZEUiDX6hkv+iM9VRJV9rdZKJU0RFa2BEZ/2o84YY56KY6ky2TF7xH JgsVFPWO7E67zo9rT9wac9Ggls1y83BG8dJZaXoZixvy2yeiy350y7sKHmO85Bd9GN66rZHVFjR9/ Kp888ZjnKK0m4nJezgijPy+RXJOzglyKySOXSQf/1VssBrZNjc9jj1q/VTJdR1EPLKyIA/CrtPM0/ CIe9TAGbC+o6h5VitwTWhKASMgs1xJo1666BAVD2KT50hcfQIrwOJKwhLHT//YvtmXw4LxIRh2jvJ 5mdXx8SCP790KQtWunqIF8LMHaaUvvzddnktoLHA2/igM+7ki+uG8dcBOKmS8dsDVee7jDw1ppP/M VW6o0jzWITLPF34lc1dPsXleQqRMSjtVsAjLFjuY81puVAo8Ut6vxkvfzb7dcf/q1g/lSU1jYW2fj /rAUp1bqk93Mur+X+z9lvDKjBHzRnzP2wr3gzR5w14KIP5va1ieqJEKHwl4yntkKLLIIaPkHIDlfO b5FZSDTJiGXVgcS1v56vzDv534Jmc+3QFyTZ1LlX4RTdR93tGZrXL3xjPmFFlI22a+IB1E+yFmACc XPwhkoBbGQT+yg617n1nQlE6lF1P09ORrpVUOvL+syRs2iue1ETGaauQ6ztVGmpbD1k+ZKeku/dlH KsIoWitqXqG/eGRu9R1XATCvOnvHzxWYkFJyv47PBXH/e2BDiUC4NQQTCGnWt+XWJodg19f/8nHzS TRH+XBZ76ULCwBL2I5x19vhH7m3GXp X-HAS-ATTACH: no X-QQ-BUSINESS-ORIGIN: 2 X-Originating-IP: 255.51.246.161 X-QQ-mid: webmail543t1670201893t8927532 X-Priority: 3 X-QQ-MIME: TCMime 1.0 by Tencent X-Mailer: QQMail 2.x X-QQ-Mailer: QQMail 2.x X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:249980 Archived-At: This is a multi-part message in MIME format. ------=_NextPart_638D4225_0FED55A0_1F60518E Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: base64 Jmd0OyBQbGVhc2UgdW5kZXJzdGFuZDogZXRhZ3MgaXMgYSBzdGFibGUgcHJvZ3JhbS4mbmJz cDsgSSdtIG5vdCBpbnRlcmVzdGVkIGluDQomZ3Q7IGNoYW5nZXMgdGhhdCBtb2RpZnkgaXRz IGRlc2lnbiBvciBpbXBsZW1lbnRhdGlvbiBpbiBzdWNoIGRyYXN0aWMgd2F5cy4NCg0KSSB1 bmRlcnN0YW5kLCBidXQgbm90IGNvbXBsZXRlbHkgYWdyZWUsIHN0YWJsZSAhPSBzZWN1cml0 eS4NCg0KV2h5IHVzZSB0aGUgc3lzdGVtKCkgZnVuY3Rpb24/IFRoaXMgaXMgYSBsYXp5LCBp bnNlY3VyZSBsaXR0bGUgdHJpY2ssDQp0aGUgZXhlYyooc3VjaCBhcyBleGVjdnApIGZ1bmN0 aW9uIHNob3VsZCBiZSB1c2VkIGZpcnN0LiBXZSBuZWVkDQpleGVjdXRlIGEgY29tbWFuZCwg YnV0IHdlIGRvbid0IG5lZWQgZXhlY3V0ZSBhIHNoZWxsIHNjcmlwdC4NCg0KRXhhbXBsZSBh IGNhc2UsIEluIG15IHRlYW0sIHNvbWUgcGVvcGxlIGxpa2UgYXV0b21hdGljYWxseSBwdWxs IG5ldw0KY29kZSBmcm9tIGNvZGUgc2VydmVyLCBhbmQgdXNlIGV0YWdzIHVwZGF0ZSB0YWdz LCBzbyBJIHNlY3JldGx5IHVwbG9hZGVkDQphIG5ldyBmaWxlLCB0aGUgZmlsZSBuYW1lIGlz Og0KDQokIHRvdWNoICInO2N1cmwgbXlob3N0fHNoICMnYS56Ig0KDQp3aGVuIGhlIGF1dG9t YXRpY2FsbHkgdXBkYXRlIHRoZSB0YWdzLCBJIGhhY2tpbmcgaGlzIGNvbXB1dGVyLg0KDQpT bywgSSBoYXZlIHR3byBzdWdnZXN0aW9uczoNCg0KMS4gZG9uJ3QgdXNlIHN5c3RlbSgpLCB1 bmxlc3Mga25vdyB3aGF0IGFyZSBkb2luZy4NCg0KMi4gZXNjYXBlIGFsbCBkYW5nZXJvdXMg Y2hhcmFjdGVycywganVzdCBlc2NhcGluZyBxdW90ZXMgaXMgbm90DQplbm91Z2gsIHRoZSBm b2xsb3dpbmcgY2hhcmFjdGVycyBjYW4gcGVyZm9ybSBhZGRpdGlvbmFsIGFjdGlvbnM6DQoN CiIkKGxzKSINCiJgbHNgIg0KIiR7U0hFTEx9Ig0KIiRTSEVMTCINCg0KSSdtIHdyaXRpbmcg YSBuZXcgcGF0Y2ggdG8gZXNjYXBlIGRhbmdlcm91cyBjaGFyYWN0ZXJzLCBhbmQgdGVzdC4N Cg0KVGhhbmtzLg== ------=_NextPart_638D4225_0FED55A0_1F60518E Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: base64 Jmd0OyBQbGVhc2UgdW5kZXJzdGFuZDogZXRhZ3MgaXMgYSBzdGFibGUgcHJvZ3JhbS4mbmJz cDsgSSdtIG5vdCBpbnRlcmVzdGVkIGluPGJyPiZndDsgY2hhbmdlcyB0aGF0IG1vZGlmeSBp dHMgZGVzaWduIG9yIGltcGxlbWVudGF0aW9uIGluIHN1Y2ggZHJhc3RpYyB3YXlzLjxicj48 YnI+SSB1bmRlcnN0YW5kLCBidXQgbm90IGNvbXBsZXRlbHkgYWdyZWUsIHN0YWJsZSAhPSBz ZWN1cml0eS48YnI+PGJyPldoeSB1c2UgdGhlIHN5c3RlbSgpIGZ1bmN0aW9uPyBUaGlzIGlz IGEgbGF6eSwgaW5zZWN1cmUgbGl0dGxlIHRyaWNrLDxicj50aGUgZXhlYyooc3VjaCBhcyBl eGVjdnApIGZ1bmN0aW9uIHNob3VsZCBiZSB1c2VkIGZpcnN0LiBXZSBuZWVkPGJyPmV4ZWN1 dGUgYSBjb21tYW5kLCBidXQgd2UgZG9uJ3QgbmVlZCBleGVjdXRlIGEgc2hlbGwgc2NyaXB0 Ljxicj48YnI+RXhhbXBsZSBhIGNhc2UsIEluIG15IHRlYW0sIHNvbWUgcGVvcGxlIGxpa2Ug YXV0b21hdGljYWxseSBwdWxsIG5ldzxicj5jb2RlIGZyb20gY29kZSBzZXJ2ZXIsIGFuZCB1 c2UgZXRhZ3MgdXBkYXRlIHRhZ3MsIHNvIEkgc2VjcmV0bHkgdXBsb2FkZWQ8YnI+YSBuZXcg ZmlsZSwgdGhlIGZpbGUgbmFtZSBpczo8YnI+PGJyPiQgdG91Y2ggIic7Y3VybCBteWhvc3R8 c2ggIydhLnoiPGJyPjxicj53aGVuIGhlIGF1dG9tYXRpY2FsbHkgdXBkYXRlIHRoZSB0YWdz LCBJIGhhY2tpbmcgaGlzIGNvbXB1dGVyLjxicj48YnI+U28sIEkgaGF2ZSB0d28gc3VnZ2Vz dGlvbnM6PGJyPjxicj4xLiBkb24ndCB1c2Ugc3lzdGVtKCksIHVubGVzcyBrbm93IHdoYXQg YXJlIGRvaW5nLjxicj48YnI+Mi4gZXNjYXBlIGFsbCBkYW5nZXJvdXMgY2hhcmFjdGVycywg anVzdCBlc2NhcGluZyBxdW90ZXMgaXMgbm90PGJyPmVub3VnaCwgdGhlIGZvbGxvd2luZyBj aGFyYWN0ZXJzIGNhbiBwZXJmb3JtIGFkZGl0aW9uYWwgYWN0aW9uczo8YnI+PGJyPiIkKGxz KSI8YnI+ImBsc2AiPGJyPiIke1NIRUxMfSI8YnI+IiRTSEVMTCI8YnI+PGJyPkknbSB3cml0 aW5nIGEgbmV3IHBhdGNoIHRvIGVzY2FwZSBkYW5nZXJvdXMgY2hhcmFjdGVycywgYW5kIHRl c3QuPGJyPjxicj5UaGFua3MuPGJyPjxicj48YnI+ ------=_NextPart_638D4225_0FED55A0_1F60518E-- É