Security flaw in pgg-gpg-process-region? (was: pgg-gpg-process-region)

[Reiner Steib <reinersteib+gmane@imap.cc>]

[ Adding emacs-devel; therefore not trimming quotes.  See
  <http://thread.gmane.org/gmane.emacs.devel/43396/focus=52626> for
  the rest of the discussion. ]

On Sat, May 06 2006, Reiner Steib wrote:

> On Thu, Apr 27 2006, Romain Francoise wrote:
>
>> Daiki Ueno <ueno@unixuser.org> writes:
>>
>>> For example, the original PGG does not use `call-process-region' for
>>> security reason -- this function writes data to a temporary file.
>
> Did you check which versions of Emacs or XEmacs do this?  (I don't
> have the C sources here ATM, so I can't check myself.)

In current Emacs CVS in fact `call-process-region' uses temp files.
Bad.  I think this is a severe security problem, isn't it?  I think
this should be fixed before the release.

>>> About three years ago, Gnus decided to use `call-process-region' in
>>> PGG to avoid display blinking.
>>
>> The current version of PGG in the trunk doesn't do that anymore.
>> That sounds like a good enough reason to sync that version in v5-10!
>
> Maybe we should rather revert the change introducing
> `call-process-region' [1]?  

The revered patch doesn't apply anymore.  Could someone please look
for a possibility to avoid `call-process-region' in
`pgg-gpg-process-region' or suggest an alternative solution?

> Have all the problems that led us to revert pgg-gpg.el before the
> 5.10.8 release been fixed in the trunk version (or in Daiki's
> version)?
>
> Bye, Reiner.
>
> [1]
> ,----[ ChangeLog.2 ]
> | 2003-02-08  Simon Josefsson  <jas@extundo.com>
> | 
> | 	* gnus-sum.el (gnus-summary-select-article): Remove blink removal
> | 	code that only worked under Emacs.
> | 
> | 	* pgg-gpg.el (pgg-gpg-process-region): Don't blink.  From Satyaki
> | 	Das <satyaki@chicory.stanford.edu>.
> `----
>
> --- pgg-gpg.el	2 Nov 2002 04:27:00 -0000	6.8
> +++ pgg-gpg.el	8 Feb 2003 18:58:23 -0000	6.9
> @@ -59,27 +59,22 @@
>  	 (errors-buffer pgg-errors-buffer)
>  	 (orig-mode (default-file-modes))
>  	 (process-connection-type nil)
> -	 process status exit-status)
> +	 exit-status)
>      (with-current-buffer (get-buffer-create errors-buffer)
>        (buffer-disable-undo)
>        (erase-buffer))
>      (unwind-protect
>  	(progn
>  	  (set-default-file-modes 448)
> -	  (let ((coding-system-for-write 'binary))
> -	    (setq process
> -		  (apply #'start-process "*GnuPG*" errors-buffer
> -			 program args)))
> -	  (set-process-sentinel process #'ignore)
> -	  (when passphrase
> -	    (process-send-string process (concat passphrase "\n")))
> -	  (process-send-region process start end)
> -	  (process-send-eof process)
> -	  (while (eq 'run (process-status process))
> -	    (accept-process-output process 5))
> -	  (setq status (process-status process)
> -		exit-status (process-exit-status process))
> -	  (delete-process process)
> +          (let* ((coding-system-for-write 'binary)
> +                 (input (buffer-substring-no-properties start end)))
> +            (with-temp-buffer
> +              (when passphrase
> +                (insert passphrase "\n"))
> +              (insert input)
> +              (setq exit-status
> +                    (apply #'call-process-region (point-min) (point-max) program
> +                           nil errors-buffer nil args))))
>  	  (with-current-buffer (get-buffer-create output-buffer)
>  	    (buffer-disable-undo)
>  	    (erase-buffer)
> @@ -87,12 +82,8 @@
>  		(let ((coding-system-for-read 'raw-text-dos))
>  		  (insert-file-contents output-file-name)))
>  	    (set-buffer errors-buffer)
> -	    (if (memq status '(stop signal))
> -		(error "%s exited abnormally: '%s'" program exit-status))
> -	    (if (= 127 exit-status)
> -		(error "%s could not be found" program))))
> -      (if (and process (eq 'run (process-status process)))
> -	  (interrupt-process process))
> +	    (if (not (equal exit-status 0))
> +		(error "%s exited abnormally: '%s'" program exit-status))))
>        (if (file-exists-p output-file-name)
>  	  (delete-file output-file-name))
>        (set-default-file-modes orig-mode))))

-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/