From: charles@aurox.ch (Charles A. Roelli)
To: Paul Eggert <eggert@cs.ucla.edu>
Cc: larsi@gnus.org, 28350@debbugs.gnu.org
Subject: bug#28350: enriched.el code execution
Date: Sun, 10 Sep 2017 20:54:13 +0200 [thread overview]
Message-ID: <m24lsa9yga.fsf@aurox.ch> (raw)
In-Reply-To: <305e0573-2e10-cb15-4133-9bd72d33ea5e@cs.ucla.edu> (message from Paul Eggert on Sat, 9 Sep 2017 15:43:30 -0700)
> From: Paul Eggert <eggert@cs.ucla.edu>
> Date: Sat, 9 Sep 2017 15:43:30 -0700
>
> Thanks for reporting this bug. Since it is a serious security hole I have
> installed a patch by Lars Ingebrigtsen that temporarily disables the problematic
> translations, and that also changes Gnus to not call enriched-decode. For the
> emacs-25 branch the patch is here:
>
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70
>
> and for the master branch the patch is here:
>
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=19584f13b1e2e4a778602a8302619ef5c675e68b
>
> As this patch is merely a workaround to close the security hole, I am not
> marking the underlying bug as fixed.
>
> Thank you for reporting the problem.
Thanks for these fixes. I have some comments:
> branch: master
> commit 19584f13b1e2e4a778602a8302619ef5c675e68b
> Author: Lars Ingebrigtsen <larsi@gnus.org>
> Commit: Paul Eggert <eggert@cs.ucla.edu>
>
> [...]
>
> --- a/lisp/textmodes/enriched.el
> +++ b/lisp/textmodes/enriched.el
> @@ -117,12 +117,7 @@ expression, which is evaluated to get the string to insert.")
> (full "flushboth")
> (center "center"))
> (PARAMETER (t "param")) ; Argument of preceding annotation
> - ;; The following are not part of the standard:
> - (FUNCTION (enriched-decode-foreground "x-color")
> - (enriched-decode-background "x-bg-color")
Do we know that "x-color" and/or "x-bg-color" are vulnerable to a
similar misuse as "x-display"? If not, I can still re-add them at a
later time.
> branch: emacs-25
> commit b6389930146882a77c22901a4357e287826fc7ff
> Author: Paul Eggert <eggert@cs.ucla.edu>
> Commit: Paul Eggert <eggert@cs.ucla.edu>
>
> [...]
>
> +** Enriched text mode no longer supports the 'FUNCTION' and 'display'
> +translations, and Gnus no longer processes enriched text when
> +inlining. This fixes bugs introduced in Emacs 19.29. To work around
> +these bugs in Emacs versions 19.29 through 25.2, append the following
> +to your ~/.emacs file:
> +
> + (provide 'enriched)
> + (defun enriched-mode (&optional arg))
> + (defun enriched-decode (from to))
This fix is very safe, at the cost of disabling Enriched mode. Could
we do any better? I had suggested the following (in
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350#16):
(eval-after-load "enriched"
'(defun enriched-decode-display-prop (start end &optional param)
(list start end)))
But it may not work in Emacs earlier than 23 (I can't test it).
next prev parent reply other threads:[~2017-09-10 18:54 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-04 19:24 bug#28350: enriched.el code execution Charles A. Roelli
2017-09-06 19:25 ` Charles A. Roelli
2017-09-07 2:34 ` Eli Zaretskii
2017-09-09 12:23 ` Charles A. Roelli
2017-09-09 13:45 ` Eli Zaretskii
2017-09-09 15:57 ` Charles A. Roelli
2017-09-09 16:55 ` Eli Zaretskii
2017-09-09 20:37 ` Charles A. Roelli
2017-09-10 17:01 ` Eli Zaretskii
2017-09-11 16:32 ` Glenn Morris
2017-09-11 17:01 ` Eli Zaretskii
2017-09-09 22:43 ` Paul Eggert
2017-09-10 18:54 ` Charles A. Roelli [this message]
2017-09-10 21:46 ` Paul Eggert
2017-09-11 2:39 ` Eli Zaretskii
2017-09-11 14:22 ` Eli Zaretskii
2017-09-11 15:18 ` Eli Zaretskii
2017-09-11 18:44 ` Charles A. Roelli
2017-09-11 19:07 ` Eli Zaretskii
2017-09-16 9:48 ` Eli Zaretskii
2017-09-11 15:33 ` Glenn Morris
2017-09-11 16:38 ` Paul Eggert
2017-09-11 21:16 ` Glenn Morris
2017-09-12 19:59 ` Paul Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m24lsa9yga.fsf@aurox.ch \
--to=charles@aurox.ch \
--cc=28350@debbugs.gnu.org \
--cc=eggert@cs.ucla.edu \
--cc=larsi@gnus.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.