commit
027293d5d7
GPG Key ID:
D87CBBC16D2E4A72
@ -0,0 +1,68 @@
|
|||||||
|
From f4cc61636947b5c2f0afc67174dd369fe3277aa8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ihor Radchenko <yantar92@posteo.net>
|
||||||
|
Date: Tue, 18 Jun 2024 13:06:44 +0200
|
||||||
|
Subject: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code
|
||||||
|
|
||||||
|
* lisp/org/ol.el (org-link-expand-abbrev): Refuse expanding %(...) link
|
||||||
|
abbrevs that specify unsafe function. Instead, display a warning, and
|
||||||
|
do not expand the abbrev. Clear all the text properties from the
|
||||||
|
returned link, to avoid any potential vulnerabilities caused by
|
||||||
|
properties that may contain arbitrary Elisp.
|
||||||
|
---
|
||||||
|
lisp/org/ol.el | 40 +++++++++++++++++++++++++++++-----------
|
||||||
|
1 file changed, 29 insertions(+), 11 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lisp/org/ol.el b/lisp/org/ol.el
|
||||||
|
index 7a7f4f5..8a556c7 100644
|
||||||
|
--- a/lisp/org/ol.el
|
||||||
|
+++ b/lisp/org/ol.el
|
||||||
|
@@ -1152,17 +1152,35 @@ Abbreviations are defined in `org-link-abbrev-alist'."
|
||||||
|
(if (not as)
|
||||||
|
link
|
||||||
|
(setq rpl (cdr as))
|
||||||
|
- (cond
|
||||||
|
- ((symbolp rpl) (funcall rpl tag))
|
||||||
|
- ((string-match "%(\\([^)]+\\))" rpl)
|
||||||
|
- (replace-match
|
||||||
|
- (save-match-data
|
||||||
|
- (funcall (intern-soft (match-string 1 rpl)) tag))
|
||||||
|
- t t rpl))
|
||||||
|
- ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
|
||||||
|
- ((string-match "%h" rpl)
|
||||||
|
- (replace-match (url-hexify-string (or tag "")) t t rpl))
|
||||||
|
- (t (concat rpl tag)))))))
|
||||||
|
+ ;; Drop any potentially dangerous text properties like
|
||||||
|
+ ;; `modification-hooks' that may be used as an attack vector.
|
||||||
|
+ (substring-no-properties
|
||||||
|
+ (cond
|
||||||
|
+ ((symbolp rpl) (funcall rpl tag))
|
||||||
|
+ ((string-match "%(\\([^)]+\\))" rpl)
|
||||||
|
+ (let ((rpl-fun-symbol (intern-soft (match-string 1 rpl))))
|
||||||
|
+ ;; Using `unsafep-function' is not quite enough because
|
||||||
|
+ ;; Emacs considers functions like `genenv' safe, while
|
||||||
|
+ ;; they can potentially be used to expose private system
|
||||||
|
+ ;; data to attacker if abbreviated link is clicked.
|
||||||
|
+ (if (or (eq t (get rpl-fun-symbol 'org-link-abbrev-safe))
|
||||||
|
+ (eq t (get rpl-fun-symbol 'pure)))
|
||||||
|
+ (replace-match
|
||||||
|
+ (save-match-data
|
||||||
|
+ (funcall (intern-soft (match-string 1 rpl)) tag))
|
||||||
|
+ t t rpl)
|
||||||
|
+ (org-display-warning
|
||||||
|
+ (format "Disabling unsafe link abbrev: %s
|
||||||
|
+You may mark function safe via (put '%s 'org-link-abbrev-safe t)"
|
||||||
|
+ rpl (match-string 1 rpl)))
|
||||||
|
+ (setq org-link-abbrev-alist-local (delete as org-link-abbrev-alist-local)
|
||||||
|
+ org-link-abbrev-alist (delete as org-link-abbrev-alist))
|
||||||
|
+ link
|
||||||
|
+ )))
|
||||||
|
+ ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
|
||||||
|
+ ((string-match "%h" rpl)
|
||||||
|
+ (replace-match (url-hexify-string (or tag "")) t t rpl))
|
||||||
|
+ (t (concat rpl tag))))))))
|
||||||
|
|
||||||
|
(defun org-link-open (link &optional arg)
|
||||||
|
"Open a link object LINK.
|
||||||
|
--
|
||||||
|
cgit v1.1
|
||||||
|
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQENBF+pf4UBCAC6vjkWLSAsQpe8YIGKLQzNOJx/IjGtCdFF8uzmO5jmME+SD8RO
|
||||||
|
uJN+t5KXVw58uzu75EFD0vHTY9e+udJ2gkpuy0NnzkFcbumdLLo2ERKCoSctZZRh
|
||||||
|
zKXI5z5cHxCqW0B2ygHRrRLtoNlGID7bAgcgSViT1ptGqTXO7zGVu4Airok7dNzc
|
||||||
|
PtHgns8GlR5YAFX0TvE6oGd0l2VPghNeVJKJOjrbfhoDxl3ucFpqbqMH8z9HTLDO
|
||||||
|
Fpz8UaYYUdJMi3xX6vwTZxI2sM2RRVLUpZyllAkSMI4lln1OOgazM/62DJUs/rKI
|
||||||
|
HKBnF6h3/qsJUjUYXaAHbrXY26mWllAd536lABEBAAG0I0VsaSBaYXJldHNraWkg
|
||||||
|
KGVsaXopIDxlbGl6QGdudS5vcmc+iQE4BBMBAgAiBQJfqX+FAhsDBgsJCAcDAgYV
|
||||||
|
CAIJCgsEFgIDAQIeAQIXgAAKCRCRwSYvAeuNOYUQB/4/iIKKOG45ijNaRoTvmJJZ
|
||||||
|
Mvj1S07WQxEm7c5SHEeEQbLOAxB9vESOV7sLueuN3oqEndtzyYt4x1WTSBmHFF7h
|
||||||
|
5fcCMjBs41siOIp5Sj/xD0Bvaa0IKGCRSZ7PAo8Mq3wgajXpTpn9vxE2PmtzA8Kd
|
||||||
|
EE0K1+f9pVAfOpUIcCl44rIxLUW352XG0y7iz6c/O6LB1deOKMiKFctKO7pBti1d
|
||||||
|
JEm1ImewLH3H8uTbwspLOs3EB8xhsESxmTidnze68HX2jt+2EeMgCdkiNU+LWbex
|
||||||
|
QZPfIS7+ZmE06ll0v6+Jy7ZdTkCCRypKWTnW7pIFsq/p4kybV8O/kHSV6B4vvQBf
|
||||||
|
uQENBF+pf4UBCACvFrdx/m22lgObypSmSS4TNlNvQnMUorrMmp0U32hv5adt6CKX
|
||||||
|
eMjk05F+GcIfVMrpxqMBn4sEUIXWhhogQJa9ZbWEP/HbS8XjMMbz0Q0Siaty9+DS
|
||||||
|
spK/9u2GWKsz3uQzLCexIJtzmXvjAVmvoMCAU/F2t038ggygjYLRgyLRNLgbbart
|
||||||
|
u2dMkvrfxRjheip60S4S3utOcwUf/qdoa1grNannCFluHr/ftXCeeuGB4H8iO0BX
|
||||||
|
WNby6NZPizxJttx9gdcH8/OmDOJkXyRMTT/3sSem76CSOjfXcz7saJlg680NQhG5
|
||||||
|
TmuYERjJD4+U02K5RuqTsEnOuWeFy4p+/mslABEBAAGJAR8EGAECAAkFAl+pf4UC
|
||||||
|
GwwACgkQkcEmLwHrjTno7Af/a1XoLHxAUkS43nmF8iazn3ZnuwWKWLEAsNrxk56y
|
||||||
|
UxhUPRzNs0/fsABDQR1o0DyTqbScKOcOMSG2YMCctLiDd7FdfMWwkUsV9GUpPBiR
|
||||||
|
tD60Ewmn9sbNJKrEoZ5L6sqOUEslJRVABu5taOzVIRfeUPPaMRjvCcr0d+epKjW8
|
||||||
|
1J9Aqj8SskuNkHwvHchTYFYVT22aemjjZ1MGOUm7QiybWQgYL6aSPV2gR+NQQ7pE
|
||||||
|
hOBoEi6GLEiBkoYOIXvmxsqQLBrUPbsJq8lItYEaw4HGt8BaPxtK2yZ9mSqC2xhW
|
||||||
|
Yr1j1YAIHffzubC0jxc5znXERsRANoJOwNUXmiddD7UM9A==
|
||||||
|
=g4R7
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
Loading…
Reference in new issue