File CVE-2024-39331.patch of Package emacs.34545

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2024-39331.patch of Package emacs.34545

commit c645e1d8205f0f0663ec4a2d27575b238c646c7c
Author: Ihor Radchenko <yantar92@posteo.net>
Date:   Fri Jun 21 15:45:25 2024 +0200

org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code
    
    * lisp/org/ol.el (org-link-expand-abbrev): Refuse expanding %(...)
    link abbrevs that specify unsafe function.  Instead, display a
    warning, and do not expand the abbrev.  Clear all the text properties
    from the returned link, to avoid any potential vulnerabilities caused
    by properties that may contain arbitrary Elisp.

---
 lisp/org/org.el |   40 ++++++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)

--- lisp/org/org.el
+++ lisp/org/org.el	2024-07-02 07:28:19.218572632 +0000
@@ -8819,7 +8819,7 @@ property to set."
 
 (defun org-link-expand-abbrev (link)
   "Apply replacements as defined in `org-link-abbrev-alist'."
-  (if (string-match "^\$[^:]*\$\$::?\\(.*\$\\)?$" link)
+  (if (not (string-match "^\$[^:]*\$\$::?\\(.*\$\\)?$" link)) link
       (let* ((key (match-string 1 link))
 	     (as (or (assoc key org-link-abbrev-alist-local)
 		     (assoc key org-link-abbrev-alist)))
@@ -8828,15 +8828,35 @@ property to set."
 	(if (not as)
 	    link
 	  (setq rpl (cdr as))
-	  (cond
-	   ((symbolp rpl) (funcall rpl tag))
-	   ((string-match "%(\$[^)]+\$)" rpl)
-	    (replace-match (funcall (intern-soft (match-string 1 rpl)) tag) t t rpl))
-	   ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
-	   ((string-match "%h" rpl)
-	    (replace-match (url-hexify-string (or tag "")) t t rpl))
-	   (t (concat rpl tag)))))
-    link))
+        ;; Drop any potentially dangerous text properties like
+        ;; `modification-hooks' that may be used as an attack vector.
+        (substring-no-properties
+	 (cond
+	  ((symbolp rpl) (funcall rpl tag))
+	  ((string-match "%(\$[^)]+\$)" rpl)
+           (let ((rpl-fun-symbol (intern-soft (match-string 1 rpl))))
+             ;; Using `unsafep-function' is not quite enough because
+             ;; Emacs considers functions like `genenv' safe, while
+             ;; they can potentially be used to expose private system
+             ;; data to attacker if abbreviated link is clicked.
+             (if (or (eq t (get rpl-fun-symbol 'org-link-abbrev-safe))
+                     (eq t (get rpl-fun-symbol 'pure)))
+                 (replace-match
+	          (save-match-data
+	            (funcall (intern-soft (match-string 1 rpl)) tag))
+	          t t rpl)
+               (org-display-warning
+                (format "Disabling unsafe link abbrev: %s
+You may mark function safe via (put '%s 'org-link-abbrev-safe t)"
+                        rpl (match-string 1 rpl)))
+               (setq org-link-abbrev-alist-local (delete as org-link-abbrev-alist-local)
+                     org-link-abbrev-alist (delete as org-link-abbrev-alist))
+               link
+	       )))
+	  ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
+	  ((string-match "%h" rpl)
+	   (replace-match (url-hexify-string (or tag "")) t t rpl))
+	  (t (concat rpl tag))))))))
 
 ;;; Storing and inserting links

Places

File CVE-2024-39331.patch of Package emacs.34545

Places