35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
|
From 820f0793f0b46448928905552726c1f1b999062f Mon Sep 17 00:00:00 2001
|
||
|
|
From: Xi Lu <lx@shellcodes.org>
|
||
|
|
Date: Tue, 10 Oct 2023 22:20:05 +0800
|
||
|
|
Subject: Fix man.el shell injection vulnerability
|
||
|
|
|
||
|
|
* lisp/man.el (Man-translate-references): Fix shell injection
|
||
|
|
vulnerability. (Bug#66390)
|
||
|
|
* test/lisp/man-tests.el (man-tests-Man-translate-references): New
|
||
|
|
test.
|
||
|
|
---
|
||
|
|
lisp/man.el | 6 +++++-
|
||
|
|
test/lisp/man-tests.el | 12 ++++++++++++
|
||
|
|
2 files changed, 17 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/lisp/man.el b/lisp/man.el
|
||
|
|
index 55cb938..d963964 100644
|
||
|
|
--- a/lisp/man.el
|
||
|
|
+++ b/lisp/man.el
|
||
|
|
@@ -761,7 +761,11 @@ and the `Man-section-translations-alist' variables)."
|
||
|
|
(setq name (match-string 2 ref)
|
||
|
|
section (match-string 1 ref))))
|
||
|
|
(if (string= name "")
|
||
|
|
- ref ; Return the reference as is
|
||
|
|
+ ;; see Bug#66390
|
||
|
|
+ (mapconcat 'identity
|
||
|
|
+ (mapcar #'shell-quote-argument
|
||
|
|
+ (split-string ref "\\s-+"))
|
||
|
|
+ " ") ; Return the reference as is
|
||
|
|
(if Man-downcase-section-letters-flag
|
||
|
|
(setq section (downcase section)))
|
||
|
|
(while slist
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|