oss-security - Re: Arbitrary shell command evaluation in Org mode (GNU Emacs)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wmmehffa.fsf@oldenburg.str.redhat.com>
Date: Mon, 24 Jun 2024 11:13:13 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Russ Allbery <eagle@...ie.org>
Cc: Ihor Radchenko <yantar92@...teo.net>,  oss-security@...ts.openwall.com
Subject: Re: Arbitrary shell command evaluation in Org mode
 (GNU Emacs)

* Russ Allbery:

> In order to disable automatic previewing of org-mode attachments, you need
> to customize mm-automatic-display to remove text/x-org from the list of
> MIME types that are automatically previewed.  (This part I have not
> tested.)

As far as I understand it, this only controls inline vs attachment
rendering.  Content-Disposition: inline MIME parts are still displayed
automatically, even if corresponding entries have been removed from
mm-automatic-display.

I looked at this and as far as I can tell, to disable rendering, you
have to remove entries from mm-inline-media-tests.  I don't think this
is possible through customization because the variable has bytecode
objects in it.

I think it should be possible to filter it down, with something like the
code below.  Some comments on the choices: Patch rendering is just too
useful to skip.  HTML rendering is necessary (and obviously quite risky)
because Jira and other tools do not generate useful plaintext mail.

It seems necessery to add explicit ignore entries for text/enriched and
text/richtext because mm-inline-text handles those internally.  The
regexp may be required because it's possible that text/enriched/… could
be used to bypass the subtype extraction in mm-handle-media-subtype.
I haven't tested any of this.

(require 'mm-decode)
(let ((result nil)
      (tail mm-inline-media-tests))
  (while tail
    (let ((type-selector (caar tail))
	  (handler (cadar tail)))
      (when (or (eq handler 'ignore)
		(and (eq handler 'mm-inline-text)
		     (not (member type-selector
				  '("text/enriched" "text/richtext"))))
		(member type-selector
			'("image/p?jpeg"
			  "image/png"
			  "image/gif"
			  "text/plain"
			  "text/x-diff"
			  "application/x-patch"
			  "text/html")))
	(push (car tail) result)))
    (setq tail (cdr tail)))
  (setq result (nreverse result))
  (push '("text/enriched.*" ignore ignore) result)
  (push '("text/richtext.*" ignore ignore) result)
  (setq mm-inline-media-tests result))

I've put these into ~/.gnus.el for now, but having them in ~/.emacs
might be a better option for other uses of Emacs MIME rendering.

Thanks,
Florian

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.