Attachment 874054 Details for Bug 1222053

CVE-2024-30203.patch for GNU Emacs 24.4

CVE-2024-30203.patch (text/plain), 2.87 KB, created by Dr. Werner Fink on 2024-04-04 12:08:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dr. Werner Fink

Created: 2024-04-04 12:08:36 UTC

Size: 2.87 KB

patch

obsolete

>From 937b9042ad7426acdcca33e3d931d8f495bdd804 Mon Sep 17 00:00:00 2001
>From: Ihor Radchenko <yantar92@posteo.net>
>Date: Tue, 20 Feb 2024 12:44:30 +0300
>Subject: * lisp/gnus/mm-view.el (mm-display-inline-fontify): Mark contents
> untrusted.
>
>---
> lisp/files.el        |    8 ++++++++
> lisp/gnus/mm-view.el |    1 +
> lisp/org/org.el      |   19 +++++++++++++++++++
> 3 files changed, 28 insertions(+)
>
>--- lisp/files.el
>+++ lisp/files.el	2024-04-04 11:44:09.341892820 +0000
>@@ -508,6 +508,14 @@ and ignores this variable."
> 		 (other :tag "Query" other))
>   :group 'find-file)
> 
>+(defvar-local untrusted-content nil
>+  "Non-nil means that current buffer originated from an untrusted source.
>+Email clients and some other modes may set this non-nil to mark the
>+buffer contents as untrusted.
>+
>+This variable might be subject to change without notice.")
>+(put 'untrusted-content 'permanent-local t)
>+
> ;; This is an odd variable IMO.
> ;; You might wonder why it is needed, when we could just do:
> ;; (set (make-local-variable 'enable-local-variables) nil)
>--- lisp/gnus/mm-view.el
>+++ lisp/gnus/mm-view.el	2024-04-04 12:05:29.210225473 +0000
>@@ -582,6 +582,7 @@ If MODE is not set, try to find mode aut
>     (with-current-buffer (generate-new-buffer "*fontification*")
>       (buffer-disable-undo)
>       (mm-enable-multibyte)
>+      (setq untrusted-content t)
>       (insert (cond ((eq charset 'gnus-decoded)
> 		     (with-current-buffer (mm-handle-buffer handle)
> 		       (buffer-string)))
>--- lisp/org/org.el
>+++ lisp/org/org.el	2024-04-04 12:02:39.861357609 +0000
>@@ -563,6 +563,24 @@ the following lines anywhere in the buff
>   :version "24.1"
>   :type 'boolean)
> 
>+(defvar untrusted-content) ; defined in files.el
>+(defvar org--latex-preview-when-risky nil
>+  "If non-nil, enable LaTeX preview in Org buffers from unsafe source.
>+
>+Some specially designed LaTeX code may generate huge pdf or log files
>+that may exhaust disk space.
>+
>+This variable controls how to handle LaTeX preview when rendering LaTeX
>+fragments that originate from incoming email messages.  It has no effect
>+when Org mode is unable to determine the origin of the Org buffer.
>+
>+An Org buffer is considered to be from unsafe source when the
>+variable `untrusted-content' has a non-nil value in the buffer.
>+
>+If this variable is non-nil, LaTeX previews are rendered unconditionally.
>+
>+This variable may be renamed or changed in the future.")
>+
> (defcustom org-insert-mode-line-in-empty-file nil
>   "Non-nil means insert the first line setting Org-mode in empty files.
> When the function `org-mode' is called interactively in an empty file, this
>@@ -17238,6 +17256,7 @@ The images can be removed again with \\[
>     (save-restriction
>       (let (beg end at msg)
> 	(cond
>+	 ((and untrusted-content (not org--latex-preview-when-risky)) nil)
> 	 ((or (equal subtree '(16))
> 	      (not (save-excursion
> 		     (re-search-backward org-outline-regexp-bol nil t))))

Actions: View

Attachments on bug 1222053: 874054