GNU bug report logs - #16984
dired-do-rename susceptible to .../~/... hijack

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 16984 in the body.
You can then email your comments to 16984 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: 積丹尼 Dan Jacobson <jidanni <at> jidanni.org>
To: bug-gnu-emacs <at> gnu.org
Subject: dired-do-rename susceptible to .../~/... hijack
Date: Tue, 11 Mar 2014 02:10:07 +0800

R runs the command dired-do-rename, which is an interactive autoloaded
compiled Lisp function in `dired-aux.el'.

Using it, I got this strange error:

Move `/home/jidanni/.cpanm/work/1327389327.6650' to `/tmp/1327389327.6650' failed:
(file-error Opening output file permission denied /home/jidanni/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01/MYMETA.json)

Well it turns out emacs' file name simplifying rules are being applied
in inappropriate places like when encountering

  /home/jidanni/.cpanm/work/1327389327.6650/accessors-1.01/~/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01:
  total 16
  drwxr-xr-x 2 jidanni 4096 2012-01-24  .
  drwxr-xr-x 3 jidanni 4096 2012-01-24  ..
  -r--r--r-- 1 jidanni 1374 2012-01-24  MYMETA.json
  -r--r--r-- 1 jidanni  456 2012-01-24  install.json

One must use /bin/mv and not dired-do-rename to get the job done right.

One can even think of ways the bad guys could exploit this to chip away
at arbitrary files.

$ apt-cache policy emacs-snapshot
emacs-snapshot:
  Installed: 2:20140101-1

Message #8 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: 積丹尼 Dan Jacobson <jidanni <at> jidanni.org>
Cc: 16984 <at> debbugs.gnu.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sat, 22 Oct 2016 22:21:20 -0400

tags 16984 confirmed
found 16984 25.1
quit

積丹尼 Dan Jacobson <jidanni <at> jidanni.org> writes:

> R runs the command dired-do-rename, which is an interactive autoloaded
> compiled Lisp function in `dired-aux.el'.
>
> Using it, I got this strange error:
>
> Move `/home/jidanni/.cpanm/work/1327389327.6650' to `/tmp/1327389327.6650' failed:
> (file-error Opening output file permission denied
> /home/jidanni/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01/MYMETA.json)
>
> Well it turns out emacs' file name simplifying rules are being applied
> in inappropriate places like when encountering
>
>   /home/jidanni/.cpanm/work/1327389327.6650/accessors-1.01/~/perl5/lib/perl5/i486-linux-gnu-thread-multi-64int/.meta/accessors-1.01:

The essential problem seems to be that there is no way to escape
filenames from substitute-in-file-name to protect a file named "~",
therefore read-file-name-default can never return a filename in a
directory with that name.

Message #15 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: npostavs <at> users.sourceforge.net
Cc: 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sun, 23 Oct 2016 09:50:30 +0300

> From: npostavs <at> users.sourceforge.net
> Date: Sat, 22 Oct 2016 22:21:20 -0400
> Cc: 16984 <at> debbugs.gnu.org
> 
> The essential problem seems to be that there is no way to escape
> filenames from substitute-in-file-name to protect a file named "~",
> therefore read-file-name-default can never return a filename in a
> directory with that name.

What about the "/:" quoting?  It works for me, when I type "/:" before
the name of the file which has a '~' character embedded in it.

Message #18 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Fri, 28 Oct 2016 22:27:13 -0400

[Message part 1 (text/plain, inline)]

severity 16984 minor
tags 16984 patch
quit

Eli Zaretskii <eliz <at> gnu.org> writes:

>> From: npostavs <at> users.sourceforge.net
>> Date: Sat, 22 Oct 2016 22:21:20 -0400
>> Cc: 16984 <at> debbugs.gnu.org
>> 
>> The essential problem seems to be that there is no way to escape
>> filenames from substitute-in-file-name to protect a file named "~",
>> therefore read-file-name-default can never return a filename in a
>> directory with that name.
>
> What about the "/:" quoting?  It works for me, when I type "/:" before
> the name of the file which has a '~' character embedded in it.

Ah, yes it works, as documented in `(emacs) Quoted File Names'.  I think
it would be nicer if Emacs' file prompts defaulted to insert this as
needed, here's a patch to do that:

[v1-0001-Quote-filenames-containing-in-prompts.patch (text/plain, attachment)]

Message #25 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: npostavs <at> users.sourceforge.net
Cc: 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sat, 29 Oct 2016 10:01:36 +0300

> From: npostavs <at> users.sourceforge.net
> Cc: 16984 <at> debbugs.gnu.org,  jidanni <at> jidanni.org
> Date: Fri, 28 Oct 2016 22:27:13 -0400
> 
> > What about the "/:" quoting?  It works for me, when I type "/:" before
> > the name of the file which has a '~' character embedded in it.
> 
> Ah, yes it works, as documented in `(emacs) Quoted File Names'.  I think
> it would be nicer if Emacs' file prompts defaulted to insert this as
> needed, here's a patch to do that:

This is good for master, but please wait for a few days in case
someone would like to comment or object.

Thanks.

Message #28 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: jidanni <at> jidanni.org, 16984 <at> debbugs.gnu.org, npostavs <at> users.sourceforge.net
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sat, 29 Oct 2016 15:23:51 +0200

Eli Zaretskii <eliz <at> gnu.org> writes:

>> From: npostavs <at> users.sourceforge.net
>> Cc: 16984 <at> debbugs.gnu.org,  jidanni <at> jidanni.org
>> Date: Fri, 28 Oct 2016 22:27:13 -0400
>> 
>> > What about the "/:" quoting?  It works for me, when I type "/:" before
>> > the name of the file which has a '~' character embedded in it.
>> 
>> Ah, yes it works, as documented in `(emacs) Quoted File Names'.  I think
>> it would be nicer if Emacs' file prompts defaulted to insert this as
>> needed, here's a patch to do that:
>
> This is good for master, but please wait for a few days in case
> someone would like to comment or object.

Prefixing with "/:" would also deactivate all file name handlers. The
file name "/ssh:user <at> host:/path/~/file" would be handled literally,
which is wrong.

> Thanks.

Best regards, Michael.

Message #31 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sat, 29 Oct 2016 11:54:56 -0400

[Message part 1 (text/plain, inline)]

Michael Albinus <michael.albinus <at> gmx.de> writes:

> Eli Zaretskii <eliz <at> gnu.org> writes:
>
>>> From: npostavs <at> users.sourceforge.net
>>> Cc: 16984 <at> debbugs.gnu.org,  jidanni <at> jidanni.org
>>> Date: Fri, 28 Oct 2016 22:27:13 -0400
>>> 
>>> > What about the "/:" quoting?  It works for me, when I type "/:" before
>>> > the name of the file which has a '~' character embedded in it.
>>> 
>>> Ah, yes it works, as documented in `(emacs) Quoted File Names'.  I think
>>> it would be nicer if Emacs' file prompts defaulted to insert this as
>>> needed, here's a patch to do that:
>>
>> This is good for master, but please wait for a few days in case
>> someone would like to comment or object.
>
> Prefixing with "/:" would also deactivate all file name handlers. The
> file name "/ssh:user <at> host:/path/~/file" would be handled literally,
> which is wrong.

Ah, good point.  How about checking (find-file-name-handler filename
'substitute-in-file-name):

[v2-0001-Quote-filenames-containing-in-prompts.patch (text/plain, attachment)]

Message #34 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sat, 29 Oct 2016 18:22:01 +0200

npostavs <at> users.sourceforge.net writes:

>> Prefixing with "/:" would also deactivate all file name handlers. The
>> file name "/ssh:user <at> host:/path/~/file" would be handled literally,
>> which is wrong.
>
> Ah, good point.  How about checking (find-file-name-handler filename
> 'substitute-in-file-name):
>  
> +           (not (let ((handler (find-file-name-handler
> +                                filename 'substitute-in-file-name)))
> +                  (and handler
> +                       (funcall handler 'substitute-in-file-name filename)))))

I would rather use (not (file-remote-p file-name))

This fixes the problem for local file names, but not for remote
ones. "/ssh:user <at> host:/path/~/file" would still be expanded to something
like "/ssh:user <at> host:/home/user/file". Well, better than nothing.

What do people think to use the "/:" prefix also for the local part of
remote file names? Then one could use "/ssh:user <at> host:/:/path/~/file",
making substitute-in-file-name a noop.

Best regards, Michael.

Message #37 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Mon, 31 Oct 2016 20:42:22 -0400

[Message part 1 (text/plain, inline)]

Michael Albinus <michael.albinus <at> gmx.de> writes:
>>  
>> +           (not (let ((handler (find-file-name-handler
>> +                                filename 'substitute-in-file-name)))
>> +                  (and handler
>> +                       (funcall handler 'substitute-in-file-name filename)))))
>
> I would rather use (not (file-remote-p file-name))

Okay.

[v3-0001-Quote-filenames-containing-in-prompts.patch (text/plain, attachment)]

[Message part 3 (text/plain, inline)]

>
> This fixes the problem for local file names, but not for remote
> ones. "/ssh:user <at> host:/path/~/file" would still be expanded to something
> like "/ssh:user <at> host:/home/user/file". Well, better than nothing.
>
> What do people think to use the "/:" prefix also for the local part of
> remote file names? Then one could use "/ssh:user <at> host:/:/path/~/file",
> making substitute-in-file-name a noop.

Makes sense to me.

Message #40 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sun, 04 Dec 2016 20:06:43 +0100

npostavs <at> users.sourceforge.net writes:

Hi Noam,

>> This fixes the problem for local file names, but not for remote
>> ones. "/ssh:user <at> host:/path/~/file" would still be expanded to something
>> like "/ssh:user <at> host:/home/user/file". Well, better than nothing.
>>
>> What do people think to use the "/:" prefix also for the local part of
>> remote file names? Then one could use "/ssh:user <at> host:/:/path/~/file",
>> making substitute-in-file-name a noop.
>
> Makes sense to me.

I've added a patch to master which allows quoting the local part of the
file name. Maybe you could rewrite your patch, using this feature.

There are also three new functions tramp-quoted-name-p, tramp-quote-name
and tramp-unquote-name. Maybe it is worth to expose them more generally,
as file-name-quoted-p, file-name-quote and file-name-unquote.

Best regards, Michael.

Message #43 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Wed, 07 Dec 2016 20:47:03 -0500

[Message part 1 (text/plain, inline)]

Michael Albinus <michael.albinus <at> gmx.de> writes:

> npostavs <at> users.sourceforge.net writes:
>>>
>>> What do people think to use the "/:" prefix also for the local part of
>>> remote file names? Then one could use "/ssh:user <at> host:/:/path/~/file",
>>> making substitute-in-file-name a noop.
>>
>> Makes sense to me.
>
> I've added a patch to master which allows quoting the local part of the
> file name. Maybe you could rewrite your patch, using this feature.
>

Something like this?

[v4-0001-Quote-filenames-containing-in-prompts.patch (text/plain, attachment)]

Message #46 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 09:23:01 +0100

npostavs <at> users.sourceforge.net writes:

Hi Noam,

>> I've added a patch to master which allows quoting the local part of the
>> file name. Maybe you could rewrite your patch, using this feature.
>
> Something like this?
> +      (if (file-remote-p filename)
> +          (tramp-quote-name filename)
> +        (concat "/:" filename))

`tramp-quote-name' works for both local and remote file names, so you
could remove the test `(file-remote-p filename)'.

As said in the other mail, it shall be made available as
`file-name-quote', therefore. Eli?

Best regards, Michael.

Message #49 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 09:39:35 -0500

Michael Albinus <michael.albinus <at> gmx.de> writes:

> npostavs <at> users.sourceforge.net writes:
>
> `tramp-quote-name' works for both local and remote file names, so you
> could remove the test `(file-remote-p filename)'.

Oh, I somehow had it in my mind that `concat' doesn't work with nil, I
must have mixed it up with `insert'.  Also, I guess most of the filename
tests should actually be looking at only the localname, so it should go
more like this:

    (defun minibuffer-maybe-quote-filename (filename)
      "Protect FILENAME from `substitute-in-file-name', as needed.
    Useful to give the user default values that won't be substituted."
      (let ((local (file-remote-p filename 'localname)))
        (if (and (not (string-prefix-p "/:" local))
                 (file-name-absolute-p filename)
                 (string-match-p "/~" local))
            (tramp-quote-name filename)
          (minibuffer--double-dollars filename))))


Regarding `tramp-quoted-name-p', you should use (string-match "\\`/:"
...) or (string-prefix-p "/:" ...), not (string-match "^/:" ...) as the
latter could get confused by newlines in filenames (of the first two, I
find the `string-prefix-p' version clearer).

Message #52 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 15:58:43 +0100

npostavs <at> users.sourceforge.net writes:

Hi Noam,

>       (let ((local (file-remote-p filename 'localname)))

Well, this is (file-local-name filename) these days.

> Regarding `tramp-quoted-name-p', you should use (string-match "\\`/:"
> ...) or (string-prefix-p "/:" ...), not (string-match "^/:" ...) as the
> latter could get confused by newlines in filenames (of the first two, I
> find the `string-prefix-p' version clearer).

In general you are right. But we don't support newlines in file names;
at least Tramp doesn't, so it makes no difference using "^/:" or "\\`/:".

`string-prefix-p' is the best choice indeed, and I thought about, but
Tramp cannot apply it yet. It has been introduced in Emacs 24.1, and
Tramp still supports Emacs 23. Well, NEWS.24 says that it exists already
since Emacs 23.2, but there is still Emacs 23.1, which is supported by
Tramp.

Best regards, Michael.

Message #55 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: jidanni <at> jidanni.org, 16984 <at> debbugs.gnu.org, npostavs <at> users.sourceforge.net
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 17:58:56 +0200

> From: Michael Albinus <michael.albinus <at> gmx.de>
> Cc: 16984 <at> debbugs.gnu.org,  Eli Zaretskii <eliz <at> gnu.org>,  jidanni <at> jidanni.org
> Date: Thu, 08 Dec 2016 09:23:01 +0100
> 
> As said in the other mail, it shall be made available as
> `file-name-quote', therefore. Eli?

Are you asking me about the function's name?  file-name-quote is OK
with me.

Message #58 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: npostavs <at> users.sourceforge.net
Cc: michael.albinus <at> gmx.de, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 18:00:16 +0200

> From: npostavs <at> users.sourceforge.net
> Cc: 16984 <at> debbugs.gnu.org,  Eli Zaretskii <eliz <at> gnu.org>,  jidanni <at> jidanni.org
> Date: Thu, 08 Dec 2016 09:39:35 -0500
> 
>     (defun minibuffer-maybe-quote-filename (filename)
>       "Protect FILENAME from `substitute-in-file-name', as needed.
>     Useful to give the user default values that won't be substituted."
>       (let ((local (file-remote-p filename 'localname)))
>         (if (and (not (string-prefix-p "/:" local))
>                  (file-name-absolute-p filename)
>                  (string-match-p "/~" local))
>             (tramp-quote-name filename)
>           (minibuffer--double-dollars filename))))

Is the argument guaranteed to come from expand-file-name?  If not, it
should also accept file names matching "\~" on MS platforms.

Thanks.

Message #61 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: jidanni <at> jidanni.org, 16984 <at> debbugs.gnu.org, npostavs <at> users.sourceforge.net
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 17:25:17 +0100

Eli Zaretskii <eliz <at> gnu.org> writes:

>> As said in the other mail, it shall be made available as
>> `file-name-quote', therefore. Eli?
>
> Are you asking me about the function's name?  file-name-quote is OK
> with me.

The question was rather whether this function (and file-name-unquote,
file-name-quoted-p) shall be exposed in files.el. I understand your
answer that you agree :-)

Best regards, Michael.

Message #64 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 18:03:32 +0100

Michael Albinus <michael.albinus <at> gmx.de> writes:

Hi Noam,

>> Regarding `tramp-quoted-name-p', you should use (string-match "\\`/:"
>> ...) or (string-prefix-p "/:" ...), not (string-match "^/:" ...) as the
>> latter could get confused by newlines in filenames (of the first two, I
>> find the `string-prefix-p' version clearer).

I have committed now a patch to the master, providing
file-name-quoted-p, file-name-quote and file-name-unquote. You might use
them, instead of their tramp-* counterparts.

I will add later on the text for the elisp manual, and for NEWS.

Best regards, Michael.

Message #67 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: jidanni <at> jidanni.org, 16984 <at> debbugs.gnu.org, npostavs <at> users.sourceforge.net
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 19:23:30 +0200

> From: Michael Albinus <michael.albinus <at> gmx.de>
> Cc: npostavs <at> users.sourceforge.net,  16984 <at> debbugs.gnu.org,  jidanni <at> jidanni.org
> Date: Thu, 08 Dec 2016 17:25:17 +0100
> 
> Eli Zaretskii <eliz <at> gnu.org> writes:
> 
> >> As said in the other mail, it shall be made available as
> >> `file-name-quote', therefore. Eli?
> >
> > Are you asking me about the function's name?  file-name-quote is OK
> > with me.
> 
> The question was rather whether this function (and file-name-unquote,
> file-name-quoted-p) shall be exposed in files.el. I understand your
> answer that you agree :-)

Yes, thanks.

Message #70 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: michael.albinus <at> gmx.de, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Thu, 08 Dec 2016 23:56:43 -0500

[Message part 1 (text/plain, inline)]

Eli Zaretskii <eliz <at> gnu.org> writes:

>> From: npostavs <at> users.sourceforge.net
>> Cc: 16984 <at> debbugs.gnu.org,  Eli Zaretskii <eliz <at> gnu.org>,  jidanni <at> jidanni.org
>> Date: Thu, 08 Dec 2016 09:39:35 -0500
>> 
>>     (defun minibuffer-maybe-quote-filename (filename)
>>       "Protect FILENAME from `substitute-in-file-name', as needed.
>>     Useful to give the user default values that won't be substituted."
>>       (let ((local (file-remote-p filename 'localname)))
>>         (if (and (not (string-prefix-p "/:" local))
>>                  (file-name-absolute-p filename)
>>                  (string-match-p "/~" local))
>>             (tramp-quote-name filename)
>>           (minibuffer--double-dollars filename))))
>
> Is the argument guaranteed to come from expand-file-name?  If not, it
> should also accept file names matching "\~" on MS platforms.

I think it does, but I'm not entirely sure.  Better safe than sorry?

[v5-0001-Quote-filenames-containing-in-prompts.patch (text/plain, attachment)]

Message #73 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: npostavs <at> users.sourceforge.net
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Fri, 09 Dec 2016 09:05:37 +0100

npostavs <at> users.sourceforge.net writes:

> Subject: [PATCH v5] Quote filenames containing '~' in prompts

LGTM.

Best regards, Michael.

Message #76 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: npostavs <at> users.sourceforge.net
Cc: michael.albinus <at> gmx.de, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Fri, 09 Dec 2016 10:19:17 +0200

> From: npostavs <at> users.sourceforge.net
> Cc: 16984 <at> debbugs.gnu.org,  michael.albinus <at> gmx.de,  jidanni <at> jidanni.org
> Date: Thu, 08 Dec 2016 23:56:43 -0500
> 
> > Is the argument guaranteed to come from expand-file-name?  If not, it
> > should also accept file names matching "\~" on MS platforms.
> 
> I think it does, but I'm not entirely sure.  Better safe than sorry?

Definitely, thanks.

Message #79 received at 16984 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 16984 <at> debbugs.gnu.org, jidanni <at> jidanni.org
Subject: Re: bug#16984: dired-do-rename susceptible to .../~/... hijack
Date: Sun, 11 Dec 2016 21:57:28 -0500

tags 16984 fixed
close 16984 26.1
quit

Michael Albinus <michael.albinus <at> gmx.de> writes:

> npostavs <at> users.sourceforge.net writes:
>
>> Subject: [PATCH v5] Quote filenames containing '~' in prompts
>
> LGTM.
>
> Best regards, Michael.

Pushed as a92a027d58cb.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.