Re: Reproducers for recent Emacs security issues

[Ihor Radchenko <yantar92@posteo.net>]

Max Nikulin <manikulin@gmail.com> writes:

> On 15/04/2024 16:46, Sean Whitton wrote:
>> 
>> emacs -q
>> M-x gnus-no-server
>> Gf ~/tmp/mbox-with-the-msgs.mbox
>> RET
>
> I am not a Gnus user, but this time I have tried it. I have realized 
> that if there is an text/x-org attachment, even a purely innocent one, 
> then it is enough to have the following in the text/plain *body* to 
> trigger an attempt to download a remote file:
>
> #+setupfile: http://localhost:8000/setup-1234567890.org
>
> it happens when I open the message, the attachment remains closed.
>
> I expect that message body should not affect attachment preview.

This sounds like gnus bug (or feature?).
I can also reproduce it.
Feel free to submit it as a separate bug report.

It does not affect the discussed vulnerability.

-- 
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>