mirrors
/
org-mode
mirror of https://git.savannah.gnu.org/git/emacs/org-mode.git
0
0
Fork 1
Code Releases Activity

fixup! org-man-open: Fix shell expansion vulnerability (Emacs bug#66390) 

The escaped string is not necessary "\\;id" on Windows/DOS.
This commit is contained in:
Ihor Radchenko 2024-01-11 16:34:09 +01:00
parent 6b60b5ac12
commit 4145ee4211
No known key found for this signature in database
GPG Key ID: 6470762A7DA11D8B
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lisp/ol-man.el
View File

@ -50,9 +50,9 @@ matched strings in man buffer."
(let* ((command (match-string 1 path))
;; FIXME: Remove after we drop Emacs 29 support.
;; Working around security bug #66390.
(command (if (equal (Man-translate-references ";id") "\\;id")
;; We are on Emacs that properly escapes man
;; command args (see Emacs commit 820f0793f0b).
(command (if (not (equal (Man-translate-references ";id") ";id"))
;; We are on Emacs that escapes man command args
;; (see Emacs commit 820f0793f0b).
command
;; Older Emacs without the fix - escape the
;; arguments ourselves.