From cde4caecff72bcd3e45818838312218dedc6e2f1 Mon Sep 17 00:00:00 2001 From: Xi Lu Date: Mon, 10 Apr 2023 22:23:09 +0800 Subject: [PATCH] Fix CVE-2023-28617. --- lisp/org/ob-latex.el | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el index d9d66ade56f..f2ab9b16c78 100644 --- a/lisp/org/ob-latex.el +++ b/lisp/org/ob-latex.el @@ -167,7 +167,7 @@ org-babel-execute:latex tmp-pdf (list org-babel-latex-pdf-svg-process) extension err-msg log-buf))) - (shell-command (format "mv %s %s" img-out out-file))))) + (rename-file img-out out-file t)))) ((string-suffix-p ".tikz" out-file) (when (file-exists-p out-file) (delete-file out-file)) (with-temp-file out-file @@ -205,17 +205,14 @@ org-babel-execute:latex (if (string-suffix-p ".svg" out-file) (progn (shell-command "pwd") - (shell-command (format "mv %s %s" - (concat (file-name-sans-extension tex-file) "-1.svg") - out-file))) + (rename-file (concat (file-name-sans-extension tex-file) "-1.svg") + out-file t)) (error "SVG file produced but HTML file requested"))) ((file-exists-p (concat (file-name-sans-extension tex-file) ".html")) (if (string-suffix-p ".html" out-file) - (shell-command "mv %s %s" - (concat (file-name-sans-extension tex-file) - ".html") - out-file) - (error "HTML file produced but SVG file requested"))))) + (rename-file (concat (file-name-sans-extension tex-file) ".html") + out-file t) + (error "HTML file produced but SVG file requested"))))) ((or (string= "pdf" extension) imagemagick) (with-temp-file tex-file (require 'ox-latex) -- 2.39.2