diff options
| author | CoprDistGit <infra@openeuler.org> | 2024-08-01 14:45:08 +0000 |
|---|---|---|
| committer | CoprDistGit <infra@openeuler.org> | 2024-08-01 14:45:08 +0000 |
| commit | dd77599e4181fe32df31d53db6da4960033b7d90 (patch) | |
| tree | b56cda9073367b16604dbdd66fcd12923a99f441 /emacs-ob-latex-command-injection-vulnerability.patch | |
| parent | 8ccab69f351d5a80602c5698dc420e18d1a583c8 (diff) | |
automatic import of emacsopeneuler24.03_LTSopeneuler23.09
Diffstat (limited to 'emacs-ob-latex-command-injection-vulnerability.patch')
| -rw-r--r-- | emacs-ob-latex-command-injection-vulnerability.patch | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/emacs-ob-latex-command-injection-vulnerability.patch b/emacs-ob-latex-command-injection-vulnerability.patch new file mode 100644 index 0000000..275ada9 --- /dev/null +++ b/emacs-ob-latex-command-injection-vulnerability.patch @@ -0,0 +1,43 @@ +From a8006ea580ed74f27f974d60b598143b04ad1741 Mon Sep 17 00:00:00 2001 +From: Xi Lu <lx@shellcodes.org> +Date: Sat, 11 Mar 2023 18:53:37 +0800 +Subject: * lisp/org/ob-latex.el: Fix command injection vulnerability + +(org-babel-execute:latex): +Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'. + +TINYCHANGE +--- + lisp/org/ob-latex.el | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el +index a2c24b3..ce39628 100644 +--- a/lisp/org/ob-latex.el ++++ b/lisp/org/ob-latex.el +@@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'." + (if (string-suffix-p ".svg" out-file) + (progn + (shell-command "pwd") +- (shell-command (format "mv %s %s" +- (concat (file-name-sans-extension tex-file) "-1.svg") +- out-file))) ++ (rename-file (concat (file-name-sans-extension tex-file) "-1.svg") ++ out-file t)) + (error "SVG file produced but HTML file requested"))) + ((file-exists-p (concat (file-name-sans-extension tex-file) ".html")) + (if (string-suffix-p ".html" out-file) +- (shell-command "mv %s %s" +- (concat (file-name-sans-extension tex-file) +- ".html") +- out-file) +- (error "HTML file produced but SVG file requested"))))) ++ (rename-file (concat (file-name-sans-extension tex-file) ".html") ++ out-file t) ++ (error "HTML file produced but SVG file requested"))))) + ((or (string= "pdf" extension) imagemagick) + (with-temp-file tex-file + (require 'ox-latex) +-- +cgit v1.1 + |