Re: master 739593d 3/5: Make gnus-copy-file act like copy-file etc.

[Paul Eggert <eggert@cs.ucla.edu>]

Eli Zaretskii wrote:
> no bot or person can reasonably
> know in advance what file or directory the user will copy/rename.

Sure they can. Here's a scenario off the top of my head. A sysadmin uses Emacs 
to examine files, and has the bad (but all-too-common) habit of copying files to 
/tmp and examining the copies so that he doesn't mistakenly change the 
originals. A malicious user asks the sysadmin to take a look at "problems" in 
the user's ~/.ssh/known_hosts file. The sysadmin does this:

M-x copy-file RET ~malicious/.ssh/known_hosts RET /tmp/known_hosts RET

but it doesn't seem to work (there's no file in /tmp afterwards), so the tired 
sysadmin figures he mistyped the command, does the copy-file again and this time 
it works so he diagnoses the "problems". Because of the Emacs security bug with 
destination directories, the malicious user has now taken over the sysadmin's 
personal and private known_hosts file.

The scenario works partly because the attacker knows the habits of the victim. 
Such habits are often easy to discover.

One possible solution to all this is to tell ones' sysadmins "Do not use Emacs: 
it has too many security holes". But I'm fond of Emacs, and would rather that 
sysadmins could trust it to do their work.