GNU bug report logs - #57752
28.1.91; emacsclient-mail.desktop doesn't work for me

Previous Next

Full log

Message #128 received at 57752 <at> debbugs.gnu.org (full text, mbox):

From: Max Nikulin <manikulin <at> gmail.com>
To: Damien Cassou <damien <at> cassou.me>, Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: Jim Porter <jporterbugs <at> gmail.com>, Peter Oliver <git <at> mavit.org.uk>,
 57752 <at> debbugs.gnu.org
Subject: Re: bug#57752: 28.1.91; emacsclient-mail.desktop doesn't work for me
Date: Wed, 26 Jul 2023 12:14:02 +0700

On 02/12/2022 21:52, Max Nikulin wrote:
> 
> bash -c 'e=${1//\\/\\\\}; e=${e///\"/\\\"}; emacsclient 
> --alternate-editor= --display="$DISPLAY" --eval=\(message-mailto\ 
> "\"$e\""\)' emacsclient-mailto %u

A similar approach has been applied in the following commits:

- c8ec0017cb9 2023-03-08 19:37:27 +0100 Ulrich Müller:
  Avoid using bash in the emacsclient desktop file
- 3c1693d08b0 2023-03-07 18:25:37 +0100 Ulrich Müller:
  Fix Elisp code injection vulnerability in emacsclient-mail.desktop
- d32091199ae 2022-12-19 16:51:20 +0100 Ulrich Müller:
  Fix quoted argument in emacsclient-mail.desktop Exec key

See
- (#60204)
- Gabriel Corona. Shell command and Emacs Lisp code
  injection in emacsclient-mail.desktop. Wed, 8 Mar 2023 12:37:29 +0100
  https://www.openwall.com/lists/oss-security/2023/03/08/2

So the specific reported issue has been fixed. I am unsure if this bug 
should be closed or it should be left open to continue discussion how to 
implement passing literal arguments through emacsclient.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.