Security flaw in enable-local-eval; new release plan

[Chong Yidong <cyd@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

Paul Ling has found a security flaw in the file-local variables code in
GNU Emacs.  When the user option `enable-local-variables' is set to
`:safe' (the default value is t), Emacs should automatically refuse to
evaluate `eval' forms in file-local variable sections.  Due to the bug,
Emacs instead automatically evaluates such `eval' forms.

Thus, if the user changes the value of `enable-local-variables' to
`:safe', visiting a malicious file can cause automatic execution of
arbitrary Emacs Lisp code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.

Attached are patches to fix this bug for Emacs 23.4 and Emacs 24.1,
written by Glenn Morris.  (The 23.4 patch should apply to the rest of
the Emacs 23.x series.)

Due to this problem, I plan to make a 24.2 release from the emacs-24
development branch.  The fix has already been committed to the emacs-24
branch, as well as the trunk.  I would like to make the release in a few
days; say, by the end of the week.  If there are any obviously-safe
bugfixes in the trunk which you would like to see backported to the
emacs-24 branch, please point these out ASAP.  Note also that this means
the current development trunk will be scheduled for Emacs 24.3.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: local-vars-patch-23.4.patch --]
[-- Type: text/x-diff, Size: 1373 bytes --]

*** emacs-23.4/lisp/files.el~	2012-08-13 10:50:42.340171173 +0800
--- emacs-23.4/lisp/files.el	2012-08-13 10:51:12.528172450 +0800
***************
*** 2986,2996 ****
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (push elt all-vars)
! 		 (or (eq enable-local-eval t)
! 		     (hack-one-local-variable-eval-safep (eval (quote val)))
! 		     (safe-local-variable-p var val)
! 		     (push elt unsafe-vars))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.
--- 2986,3001 ----
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (let ((safe (or (hack-one-local-variable-eval-safep
! 				  (eval (quote val)))
! 				 ;; In case previously marked safe (bug#5636).
! 				 (safe-local-variable-p var val))))
! 		   ;; If not safe and e-l-v = :safe, ignore totally.
! 		   (when (or safe (not (eq enable-local-variables :safe)))
! 		     (push elt all-vars)
! 		     (or (eq enable-local-eval t)
! 			 safe
! 			 (push elt unsafe-vars))))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.

Diff finished.  Mon Aug 13 10:53:45 2012

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: local-vars-patch-24.1.patch --]
[-- Type: text/x-diff, Size: 1373 bytes --]

*** emacs-24.1/lisp/files.el~	2012-08-13 10:54:50.256181658 +0800
--- emacs-24.1/lisp/files.el	2012-08-13 10:54:58.076181990 +0800
***************
*** 3107,3117 ****
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (push elt all-vars)
! 		 (or (eq enable-local-eval t)
! 		     (hack-one-local-variable-eval-safep (eval (quote val)))
! 		     (safe-local-variable-p var val)
! 		     (push elt unsafe-vars))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.
--- 3107,3122 ----
  	      ;; Obey `enable-local-eval'.
  	      ((eq var 'eval)
  	       (when enable-local-eval
! 		 (let ((safe (or (hack-one-local-variable-eval-safep
! 				  (eval (quote val)))
! 				 ;; In case previously marked safe (bug#5636).
! 				 (safe-local-variable-p var val))))
! 		   ;; If not safe and e-l-v = :safe, ignore totally.
! 		   (when (or safe (not (eq enable-local-variables :safe)))
! 		     (push elt all-vars)
! 		     (or (eq enable-local-eval t)
! 			 safe
! 			 (push elt unsafe-vars))))))
  	      ;; Ignore duplicates (except `mode') in the present list.
  	      ((and (assq var all-vars) (not (eq var 'mode))) nil)
  	      ;; Accept known-safe variables.

Diff finished.  Mon Aug 13 10:55:03 2012