Bug#905308: elpa-debian-el: deb-view.el shell of bad filename
Package: elpa-debian-el
Version: 37.5
File: /usr/share/emacs/site-lisp/elpa-src/debian-el-37/deb-view.el
In deb-view-process, the filename is not quoted when passed to the shell
in a few places, so it executes shell code on visiting a bad filename.
cd /tmp
touch ';echo hello >xyz;.deb'
emacs -q
M-: (add-to-list 'auto-mode-alist '("\.deb\\'" . deb-view-mode))
C-x C-f ;echo hello >xyz;.deb
=>
creates file /tmp/xyz
A bad filename should be unlikely, but in the interests of avoiding
accidents or malice it'd be good to be safe. It looks like all
remaining "(call-process shell-file-name ...)" can be call-process
alone, no shell.
-- System Information:
Debian Release: buster/sid
Architecture: i386 (i686)
Kernel: Linux 4.4.0-1-686-pae (SMP w/1 CPU core)
Locale: LANG=en_AU.iso88591, LC_CTYPE=en_AU.iso88591 (charmap=ISO-8859-1), LANGUAGE=en_AU:en_GB:en (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages elpa-debian-el depends on:
ii bzip2 1.0.6-8.1
ii dpkg 1.19.0.5+b1
ii emacsen-common 2.0.8
ii reportbug 7.5.0
ii xz-utils 5.2.2-1.3
Reply to: