From 0e7fe7809daa123921faa0bd088931cf8ddfd705 Mon Sep 17 00:00:00 2001 From: Ihor Radchenko Date: Tue, 20 Feb 2024 12:44:30 +0300 Subject: [PATCH] * lisp/gnus/mm-view.el (mm-display-inline-fontify): Mark contents untrusted. CVE: CVE-2024-30203 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=937b9042ad7426acdcca33e3d931d8f495bdd804] Signed-off-by: Gyorgy Sarvari --- lisp/gnus/mm-view.el | 1 + 1 file changed, 1 insertion(+) diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el index 2c40735..e24f3f3 100644 --- a/lisp/gnus/mm-view.el +++ b/lisp/gnus/mm-view.el @@ -504,6 +504,7 @@ If MODE is not set, try to find mode automatically." (setq coding-system (mm-find-buffer-file-coding-system))) (setq text (buffer-string)))) (with-temp-buffer + (setq untrusted-content t) (insert (cond ((eq charset 'gnus-decoded) (with-current-buffer (mm-handle-buffer handle) (buffer-string)))