[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#28350: enriched.el code execution
From: |
Charles A. Roelli |
Subject: |
bug#28350: enriched.el code execution |
Date: |
Sun, 10 Sep 2017 20:54:13 +0200 |
> From: Paul Eggert <eggert@cs.ucla.edu>
> Date: Sat, 9 Sep 2017 15:43:30 -0700
>
> Thanks for reporting this bug. Since it is a serious security hole I have
> installed a patch by Lars Ingebrigtsen that temporarily disables the
> problematic
> translations, and that also changes Gnus to not call enriched-decode. For the
> emacs-25 branch the patch is here:
>
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70
>
> and for the master branch the patch is here:
>
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=19584f13b1e2e4a778602a8302619ef5c675e68b
>
> As this patch is merely a workaround to close the security hole, I am not
> marking the underlying bug as fixed.
>
> Thank you for reporting the problem.
Thanks for these fixes. I have some comments:
> branch: master
> commit 19584f13b1e2e4a778602a8302619ef5c675e68b
> Author: Lars Ingebrigtsen <larsi@gnus.org>
> Commit: Paul Eggert <eggert@cs.ucla.edu>
>
> [...]
>
> --- a/lisp/textmodes/enriched.el
> +++ b/lisp/textmodes/enriched.el
> @@ -117,12 +117,7 @@ expression, which is evaluated to get the string to
> insert.")
> (full "flushboth")
> (center "center"))
> (PARAMETER (t "param")) ; Argument of preceding annotation
> - ;; The following are not part of the standard:
> - (FUNCTION (enriched-decode-foreground "x-color")
> - (enriched-decode-background "x-bg-color")
Do we know that "x-color" and/or "x-bg-color" are vulnerable to a
similar misuse as "x-display"? If not, I can still re-add them at a
later time.
> branch: emacs-25
> commit b6389930146882a77c22901a4357e287826fc7ff
> Author: Paul Eggert <eggert@cs.ucla.edu>
> Commit: Paul Eggert <eggert@cs.ucla.edu>
>
> [...]
>
> +** Enriched text mode no longer supports the 'FUNCTION' and 'display'
> +translations, and Gnus no longer processes enriched text when
> +inlining. This fixes bugs introduced in Emacs 19.29. To work around
> +these bugs in Emacs versions 19.29 through 25.2, append the following
> +to your ~/.emacs file:
> +
> + (provide 'enriched)
> + (defun enriched-mode (&optional arg))
> + (defun enriched-decode (from to))
This fix is very safe, at the cost of disabling Enriched mode. Could
we do any better? I had suggested the following (in
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350#16):
(eval-after-load "enriched"
'(defun enriched-decode-display-prop (start end &optional param)
(list start end)))
But it may not work in Emacs earlier than 23 (I can't test it).
- bug#28350: enriched.el code execution, (continued)
- bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/06
- bug#28350: enriched.el code execution, Charles A. Roelli, 2017/09/09
- bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/09
- bug#28350: enriched.el code execution, Charles A. Roelli, 2017/09/09
- bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/09
- bug#28350: enriched.el code execution, Charles A. Roelli, 2017/09/09
- bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/10
- bug#28350: enriched.el code execution, Glenn Morris, 2017/09/11
- bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/11
bug#28350: enriched.el code execution, Paul Eggert, 2017/09/09
- bug#28350: enriched.el code execution,
Charles A. Roelli <=
bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/11
bug#28350: enriched.el code execution, Charles A. Roelli, 2017/09/11
bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/11
bug#28350: enriched.el code execution, Eli Zaretskii, 2017/09/16
bug#28350: enriched.el code execution, Glenn Morris, 2017/09/11