francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
From 3a3bc6df4295ff7d5ea7193dfe0492cd858e1664 Mon Sep 17 00:00:00 2001
|
|
From: Ihor Radchenko <yantar92@posteo.net>
|
|
Date: Tue, 20 Feb 2024 14:59:20 +0300
|
|
Subject: [PATCH] org-file-contents: Consider all remote files unsafe
|
|
|
|
* lisp/org/org.el (org-file-contents): When loading files, consider all
|
|
remote files (like TRAMP-fetched files) unsafe, in addition to URLs.
|
|
|
|
CVE: CVE-2024-30205
|
|
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=2bc865ace050ff118db43f01457f95f95112b877]
|
|
|
|
Signed-off-by: Gyorgy Sarvari
|
|
---
|
|
lisp/org/org.el | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lisp/org/org.el b/lisp/org/org.el
|
|
index ab58978..03140bd 100644
|
|
--- a/lisp/org/org.el
|
|
+++ b/lisp/org/org.el
|
|
@@ -4576,12 +4576,16 @@ from file or URL, and return nil.
|
|
If NOCACHE is non-nil, do a fresh fetch of FILE even if cached version
|
|
is available. This option applies only if FILE is a URL."
|
|
(let* ((is-url (org-url-p file))
|
|
+ (is-remote (condition-case nil
|
|
+ (file-remote-p file)
|
|
+ ;; In case of error, be safe.
|
|
+ (t t)))
|
|
(cache (and is-url
|
|
(not nocache)
|
|
(gethash file org--file-cache))))
|
|
(cond
|
|
(cache)
|
|
- (is-url
|
|
+ ((or is-url is-remote)
|
|
(if (org--should-fetch-remote-resource-p file)
|
|
(condition-case error
|
|
(with-current-buffer (url-retrieve-synchronously file)
|