Re: master 739593d 3/5: Make gnus-copy-file act like copy-file etc.

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 1377 bytes --]

On 09/11/2017 07:33 PM, Katsumi Yamaoka wrote:
> But it might have to be documented in also the Gnus manual, as
> `gnus-summary-save-article' that uses the function doesn't
> specify a destination and a user has to enter the directory name.

The special behavior with gnus-summary-save-article and directories (or 
directory names) was not documented. Although I'm not a Gnus expert I 
took a stab at documenting the current behavior by installing the 
attached patch. If we revert the Gnus change (or make further changes) 
then this part of the manual will need to be revisited.

> IMHO, reverting the change would be better.

Does file name completion (TAB) cause '/' to be appended to the 
destination directory when you're using Gnus to save files? That should 
reduce the problem, though I admit it does not eliminate it.

The change was prompted by security concerns where attackers can hijack 
your data by planting symlinks at the wrong time in shared areas under 
/tmp and suchlike. We could complicate Emacs somewhat to make it more 
backwards-compatible in common cases such as yours; Eli is suggesting 
something along these lines. The tradeoff between convenience and 
security and maintainability is not obvious, though, and I worry that 
the suggestion as-is will reintroduce security problems for interactive 
users. Perhaps we can think of something better.


[-- Attachment #2: 0001-Tweak-Gnus-doc-re-gnus-copy-file.patch --]
[-- Type: text/x-patch, Size: 1117 bytes --]

From f5671c9c2d20e538f0f0eeaffbb37e592b2d232a Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 12 Sep 2017 12:15:22 -0700
Subject: [PATCH] Tweak Gnus doc re gnus-copy-file

* doc/misc/gnus.texi (Saving Articles):
Document behavior with directory name targets (Bug#27986).
Problem reported by Katsumi Yamaoka in:
http://lists.gnu.org/archive/html/emacs-devel/2017-09/msg00216.html
---
 doc/misc/gnus.texi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/misc/gnus.texi b/doc/misc/gnus.texi
index 3e9b48ec65..b002f5dea7 100644
--- a/doc/misc/gnus.texi
+++ b/doc/misc/gnus.texi
@@ -7759,7 +7759,9 @@ Saving Articles
 approach (uudecoding, unsharing) you should use @code{gnus-uu}
 (@pxref{Decoding Articles}).
 
-For the commands listed here, the target is a file.  If you want to
+For the commands listed here, the target is a file.
+A directory name (ending in @samp{/}) causes the target
+to be a file under that directory.  If you want to
 save to a group, see the @kbd{B c} (@code{gnus-summary-copy-article})
 command (@pxref{Mail Group Commands}).
 
-- 
2.13.5