From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Stefan Kangas Newsgroups: gmane.emacs.devel Subject: Re: bug#37656: 27.0.50; Arbitrary code execution with special `mode:' Date: Wed, 16 Oct 2019 01:17:51 +0200 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="99206"; mail-complaints-to="usenet@blaine.gmane.org" Cc: 37656@debbugs.gnu.org, Emacs developers To: adam plaice Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 16 01:18:14 2019 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iKW50-000PgA-84 for ged-emacs-devel@m.gmane.org; Wed, 16 Oct 2019 01:18:14 +0200 Original-Received: from localhost ([::1]:33170 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iKW4z-0006Ay-3Q for ged-emacs-devel@m.gmane.org; Tue, 15 Oct 2019 19:18:13 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:43763) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iKW4s-0006Aj-8c for emacs-devel@gnu.org; Tue, 15 Oct 2019 19:18:07 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iKW4r-0005o9-4m for emacs-devel@gnu.org; Tue, 15 Oct 2019 19:18:06 -0400 Original-Received: from mail-pg1-f170.google.com ([209.85.215.170]:35388) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1iKW4q-0005nq-Vh for emacs-devel@gnu.org; Tue, 15 Oct 2019 19:18:05 -0400 Original-Received: by mail-pg1-f170.google.com with SMTP id p30so13075564pgl.2 for ; Tue, 15 Oct 2019 16:18:04 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uy8asuFeUonxQygv5X2HT6YYit6i6IFRsw8r9Ui5FNc=; b=UqAJDLccZUYlGGM8r6g6CyGsIUU2aDBXPP/Nba8qmbp+bEvTpGR3LcpfktPSSFAcsv o5fxxHYL3dWNk7TC4ISd0f+ceUqx6uE3M836YSQW3pMgKAJKvzK5lDzyNNmjaJf1kxFU 28Q5ZSbV57cDBeHqs1silPekH6MFj4qC55Ni8voNjR1vzxnXC+EpFpR+VyM5qoGVTzj/ DuEokWkSlUdfz68Yf0/wZibWhIEGXvV23CRewjpoV3RShUvAENUR4Z+XKn6hsbpUuuAq 5r6p5DJ/EPSl0WH6O5qTROowLA+cvDSZgWP5j5k0sCEF8W595H1nVW29g0sBuC4xHVB+ QNHA== X-Gm-Message-State: APjAAAXFXQHSjgCd/k6jpj7w5Nehm/bMbcZidhAS3fmJ9U0lIYra/6+s M5o8itoW0bBaE4H6zmFgHDnquhPIsgSwRVTFqlo= X-Google-Smtp-Source: APXvYqxZV2Q34Wqc5b4IsgMrbDfD2faJ/csMJ+fkrh4jGggnTvsIqTVxcmJEDn+Xp9LMAgau1xRMGNAvpAW4nR392q8= X-Received: by 2002:a63:4046:: with SMTP id n67mr38175017pga.200.1571181483756; Tue, 15 Oct 2019 16:18:03 -0700 (PDT) In-Reply-To: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.215.170 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:241073 Archived-At: Stefan Kangas writes: > > The below patch seems to fix it by disabling the feature it exploits. > > Here is a more complete patch. Does it look like the right fix? flymake.el was first added to Emacs in version 22.1: 4bcbcb9df3 2004-05-29 Eli Zaretskii New file. The "multiple mode specification feature" dates back to: 9fa7bfe524 1993-09-11 Richard M. Stallman (hack-local-variables-prop-line): Ignore any specification for `mode:', since set-auto-mode has already handled it. (set-auto-mode): Clean up. Handle more than one `mode:' spec in -*-. The code that my proposed patch changes has stayed untouched since this 1993 commit. If we agree that disabling this feature is the solution here, a backported security fix should therefore hopefully be a one liner all the way back to version 22.1. Best regards, Stefan Kangas