[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87h6dikls3.fsf@hope.eyrie.org>
Date: Mon, 24 Jun 2024 15:39:56 -0700
From: Russ Allbery <eagle@...ie.org>
To: Florian Weimer <fweimer@...hat.com>
Cc: oss-security@...ts.openwall.com, Ihor Radchenko <yantar92@...teo.net>
Subject: Re: Arbitrary shell command evaluation in Org mode
(GNU Emacs)
Florian Weimer <fweimer@...hat.com> writes:
> As far as I understand it, this only controls inline vs attachment
> rendering. Content-Disposition: inline MIME parts are still displayed
> automatically, even if corresponding entries have been removed from
> mm-automatic-display.
> I looked at this and as far as I can tell, to disable rendering, you
> have to remove entries from mm-inline-media-tests. I don't think this
> is possible through customization because the variable has bytecode
> objects in it.
> I think it should be possible to filter it down, with something like the
> code below. Some comments on the choices: Patch rendering is just too
> useful to skip. HTML rendering is necessary (and obviously quite risky)
> because Jira and other tools do not generate useful plaintext mail.
Thank you! This was extremely helpful.
You may also want to keep message/rfc822 for better display of forwarded
mail. I am making the assumption that the recursive expansion of the
included message will apply the same rules as the outer message.
--
Russ Allbery (eagle@...ie.org) <https://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
