ndwarshuis
/
org-mode
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixup! org-man-open: Fix shell expansion vulnerability (Emacs bug#66390) 

The escaped string is not necessary "\\;id" on Windows/DOS.
This commit is contained in:
Ihor Radchenko 2024-01-11 16:34:09 +01:00
parent 6b60b5ac12
commit 4145ee4211
No known key found for this signature in database
GPG Key ID: 6470762A7DA11D8B
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lisp/ol-man.el
View File

@ -50,9 +50,9 @@ matched strings in man buffer."
(let* ((command (match-string 1 path)) (let* ((command (match-string 1 path))
;; FIXME: Remove after we drop Emacs 29 support. ;; FIXME: Remove after we drop Emacs 29 support.
;; Working around security bug #66390. ;; Working around security bug #66390.
(command (if (equal (Man-translate-references ";id") "\\;id") (command (if (not (equal (Man-translate-references ";id") ";id"))
;; We are on Emacs that properly escapes man ;; We are on Emacs that escapes man command args
;; command args (see Emacs commit 820f0793f0b). ;; (see Emacs commit 820f0793f0b).
command command
;; Older Emacs without the fix - escape the ;; Older Emacs without the fix - escape the
;; arguments ourselves. ;; arguments ourselves.