Re: three vulnerabilities, in spell-check and linter pipe-reads, and in emergency-save path

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------doUI0mTwHSfffR0EQu0YAEVF
Content-Type: multipart/mixed; boundary="------------FJwPl2ha7AW22Ll16sY1mmVr";
 protected-headers="v1"
From: Benno Schulenberg <[email protected]>
To: [email protected], [email protected]
Cc: [email protected]
Message-ID: <[email protected]>
Subject: Re: three vulnerabilities, in spell-check and linter pipe-reads, and
 in emergency-save path
References: <0100019e5d5d24b5-97a618dd-8802-48ce-81e4-4998e70f1857-000000@email.amazonses.com>
In-Reply-To: <0100019e5d5d24b5-97a618dd-8802-48ce-81e4-4998e70f1857-000000@email.amazonses.com>

--------------FJwPl2ha7AW22Ll16sY1mmVr
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

DQpIZWxsbyBBcmp1biwNCg0KW1NlbmRpbmcgYSAicHJpdmF0ZSBkaXNjbG9zdXJlIiB0byBh
IHB1YmxpYyBtYWlsaW5nIGxpc3QuLi4gaXMgcmF0aGVyIGENCmNvbnRyYWRpY3Rpb24gaW4g
dGVybXMuICA6KSAgQnV0IEkgZG9uJ3QgdGhpbmsgdGhpcyByZXBvcnQgbmVlZHMgdG8gYmUN
CnByaXZhdGUsIGFzIEkgZG9uJ3Qgc2VlIGhvdyB0aGVzZSBpc3N1ZXMgY291bGQgYmUgZXhw
bG9pdGVkLl0NCg0KDQpPcCAyNS0wNS0yMDI2IG9tIDA2OjIwIHNjaHJlZWYgU2VjdXJpbiBE
aXNjbG9zZToNCj4gSSBhbSB3cml0aW5nIHRvIHJlcG9ydCB0aHJlZSBzZWN1cml0eSB2dWxu
ZXJhYmlsaXRpZXMgSSBpZGVudGlmaWVkIGR1cmluZyBhDQo+IHN0cnVjdHVyZWQgc291cmNl
LWNvZGUgYW5kIGR5bmFtaWMgYXVkaXQgb2YgR05VIG5hbm8gbWFzdGVyIGJyYW5jaCBhdCBj
b21taXQNCj4gMWUwMjJiNTUgKCJuYW5vIDkuMCIpLCBjb25kdWN0ZWQgMjAyNi0wNS0yNCBh
cyBwYXJ0IG9mIFNlY3VyaW4ncyBvcGVuLXNvdXJjZQ0KPiB2dWxuZXJhYmlsaXR5IHJlc2Vh
cmNoIHByb2dyYW0uDQoNClRoYW5rcyBmb3IgdGhlIHJlcG9ydC4gIEkgd2lsbCBsb29rIGlu
dG8gdGhlIG1pc2hhbmRsaW5nIG9mIHBpcGUtcmVhZCBlcnJvcnMNCmluIHRoZSBpbnRlcm5h
bCBzcGVsbCBjaGVja2VyIGFuZCBpbiB0aGUgbGludGVyLiAgQXMgdG8gdGhlIHBlcm1pc3Np
b25zIG9mDQp0aGUgLnNhdmUgZW1lcmdlbmN5IGZpbGUsIEkgZG9uJ3QgdGhpbmsgdGhlcmUg
aXMgYW55IHNlY3VyaXR5IGlzc3VlIHRoZXJlOg0Kd2hlbiBhIHVzZXIgaXMgZWRpdGluZyBh
IGZpbGUgdGhhdCBpcyByZWFkYWJsZSBieSBvdGhlcnMsIHRoZW4gaW4gbXkgb3Bpbmlvbg0K
aXQgaXMgZmluZSB0aGF0IGEgaGFsZi1lZGl0ZWQgZmlsZSBpcyBhbHNvIHJlYWRhYmxlIGJ5
IHRob3NlIG90aGVycy4NCg0KDQo+ID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQo+IE5B
Tk8tMDAyIC0tIGRvX2ludF9zcGVsbGVyOiBzaXplX3QgYnl0ZXNyZWFkIHdyYXBzIG9uIEVJ
TlRSDQo+IC0+IGhlYXAgdW5kZXJ3cml0ZSBbUlVOVElNRS1WRVJJRklFRCwgQ1ZTU3YzLjEg
NS4wIE1FRElVTV0NCj4gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NCj4gDQo+IExPQ0FU
SU9OOiBzcmMvdGV4dC5jOjIzNTIgKGRlY2xhcmF0aW9uKSwgMjQ2NS0yNDcwIChsb29wKQ0K
PiBDT01NSVQgSU5UUk9EVUNJTkcgQlVHOiA4ZDI3MmRiNGUgKEJlbm5vIFNjaHVsZW5iZXJn
LCAyMDE5LTA0LTExKSAtLSBwcmVzZW50DQo+IGZvciB+NyB5ZWFycy4NCg0KV2VsbCwgdGhh
dCBjb21taXQganVzdCByZW5hbWVzIGEgZmV3IHZhcmlhYmxlcyBhbmQgY2hhbmdlcyBub3Ro
aW5nIGVsc2UuDQpUaGUgY3VycmVudCBsb2dpYyBoYXMgYmVlbiBwcmVzZW50IHNpbmNlIE1h
cmNoIDIwMDIsIG5hbm8tMS4xLjgsIGNvbW1pdA0KZjIxZjNmY2MuICAoVHdlbHZlIHllYXJz
IGxhdGVyLCBjb21taXQgNTU3NWJmYWQgY29waWVzIHRoYXQgc2FtZSBsb2dpYw0KZm9yIHRo
ZSBsaW50ZXIuKQ0KDQo+IElTU1VFOg0KPiANCj4gVGhlIHBpcGUtcmVhZCBsb29wIGluIGRv
X2ludF9zcGVsbGVyKCkgZGVjbGFyZXMgYGJ5dGVzcmVhZGAgYXMgYHNpemVfdGA6DQo+IA0K
PiBzaXplX3QgYnVmZmVyc2l6ZSwgYnl0ZXNyZWFkLCB0b3RhbHJlYWQ7IC8vIHRleHQuYzoy
MzUyDQo+IA0KPiB3aGlsZSAoKGJ5dGVzcmVhZCA9IHJlYWQodW5pcV9mZFswXSwgcG9pbnRl
ciwgcGlwZXNpemUpKSA+IDApIHsNCj4gWy4uLl0NCg0KVGhhbmtzIGZvciB0aGUgZGV0YWls
ZWQgZGVzY3JpcHRpb24sIGFuZCBmb3IgdGhlIHN1Z2dlc3RlZCBmaXguICBJIHdpbGwNCmxv
b2sgaW50byB0aGlzIGluIHRoZSBjb21pbmcgZGF5cy4NCg0KPiBOT1RFIE9OIEFTYW46IGdj
YydzIGxpYnNhbml0aXplciByZWFkKCkgaW50ZXJjZXB0b3Igb25seSBjaGVja3MgdGhlIGRl
c3RpbmF0aW9uDQo+IHJhbmdlIHdoZW4gcmVzID4gMDsgb24gRUZBVUxUIChyZXMgPCAwKSB0
aGUgc2hhZG93IGNoZWNrIGlzIHNraXBwZWQuIFRoaXMgaXMNCj4gd2h5IEFTYW4gZG9lcyBu
b3QgZmlyZSwgYW5kIGxpa2VseSB3aHkgdGhlIGJ1ZyBoYXMgc3Vydml2ZWQgc2V2ZW4geWVh
cnMgb2YNCj4gc2FuaXRpemVyLWVuYWJsZWQgcGFja2FnaW5nLg0KDQpNb3N0bHkgSSB0aGlu
ayB0aGUgaXNzdWUgaGFzIHN1cnZpdmVkIGZvciAyNCB5ZWFycyAob3IgMTIgZm9yIHRoZSBs
aW50ZXIpDQpiZWNhdXNlIDEpIHZlcnkgZmV3IHBlb3BsZSB1c2UgdGhlIGludGVybmFsIHNw
ZWxsIGNoZWNrZXIgb3IgdGhlIGxpbnRlciwNCmFuZCAyKSB3aGF0IGFyZSB0aGUgY2hhbmNl
cyBvZiBnZXR0aW5nIGEgc2lnbmFsIGR1cmluZyB0aG9zZSBwaXBlIHJlYWRzPw0KQSB1c2Vy
IGlzIHVubGlrZWx5IHRvIHNlbmQgYW55IHNpZ25hbCB0aGVtc2VsdmVzLCBhbmQgb3RoZXIg
dXNlcnMgc2hvdWxkDQpub3QgYmUgYWJsZSB0byBzZW5kIHNpZ25hbHMgdG8gdGhpcyB1c2Vy
LCByaWdodD8NCg0KDQo+ID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQo+IE5BTk8tMDA1
IC0tIGVtZXJnZW5jeV9zYXZlIGZjaG1vZCBicm9hZGVucyAuc2F2ZSBwZXJtaXNzaW9ucw0K
PiBbUlVOVElNRS1WRVJJRklFRCwgQ1ZTU3YzLjEgMy4zIExPV10NCj4gPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0NCj4gDQo+IFsuLi5dDQo+IA0KPiBJTVBBQ1Q6IFVuc2F2ZWQgYnVm
ZmVyIGNvbnRlbnRzIHdyaXR0ZW4gdG8gYSBwcmVkaWN0YWJsZSBwYXRoIGF0IHRoZSBvcmln
aW5hbA0KPiBmaWxlJ3MgcGVybWlzc2lvbnMuIEZvciB3b3JsZC1yZWFkYWJsZSBvciBncm91
cC1yZWFkYWJsZSBvcmlnaW5hbHMsIHRoZSAuc2F2ZQ0KPiBpcyBlcXVhbGx5IHJlYWRhYmxl
LCBleHBvc2luZyBpbi1wcm9ncmVzcyBlZGl0cyB0byBvdGhlciBsb2NhbCB1c2Vycy4NCg0K
V2hhdCBoYXJtIGNvdWxkIHRoZXJlIGJlIGluIGxldHRpbmcgdXNlcnMgdGhhdCBhcmUgYWJs
ZSB0byByZWFkIHRoZSB0YXJnZXQNCmZpbGUgYWxzbyByZWFkIHRoZSBpbi1wcm9ncmVzcyBl
ZGl0cyBpbiB0aGUgLnNhdmUgZmlsZT8NCg0KQnV0IGFjdHVhbGx5IEkgYWdyZWUgdGhlcmUg
aXMgbm8gbmVlZCBmb3IgdGhlIGZjaG1vZCgpIGNhbGwgKG5vciBmb3IgdGhlDQpmY2hvd24o
KSBjYWxsKSwgYXMgdGhlIHBhcnRpYWwgZWRpdHMgYXJlIG1vc3QgbGlrZWx5IG9mIGludGVy
ZXN0IG9ubHkgdG8NCnRoZSBlZGl0aW5nIHBlcnNvbi4gIEFuZCBpbiBjYXNlIHJvb3Qgd2Fz
IGVkaXRpbmcgdGhlIGZpbGUgd2hlbiBuYW5vIHdhcw0Ka2lsbGVkLCB0aGVuIGl0IHdpbGwg
YmUgc3RyYW5nZSBmb3IgdGhlIG93bmVyIG9mIHRoZSBmaWxlIHRvIGxhdGVyIGZpbmQNCnRo
aXMgLnNhdmUgZmlsZSBhbmQgd29uZGVyOiBodWgsIGRpZCBJIGVkaXQgdGhhdCBmaWxlIGFy
b3VuZCB0aGF0IHRpbWU/DQoNCg0KQmVubm8NCg==

--------------FJwPl2ha7AW22Ll16sY1mmVr--

--------------doUI0mTwHSfffR0EQu0YAEVF
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEFo5vQpe/16ea/USWUUu+Lrjhlh8FAmoUOWAFAwAAAAAACgkQUUu+Lrjhlh/W
zRAAgRqD7GB2ePOT0QFgbLtEroxmX+ILDQwUS638Y8YmubtzQSZh7CsZY5bg2l5hLXsZDV8xwnDg
GWS+wzW2/b5O395sh50qsXy2KLS8EIV86MwX9BBws1BSnL/iYlE/hqk5Gm7bIeszNMHX1SA+HquL
N2cOBcTr2L2T1KQ3ThNgbsvltmOxPBLY9pOsxvY906T+VhOoAsvWJntvP10B3sCP1+8vtikamqCP
lkKMMv9O8ljsHEiYeVtXPo5238DkyG/Um3dIzL7LfVYexldWJQfP5ptV7gKFsQ1NrJRpt+F3j7a2
DBwq0uzt7L+C6jKFRoOxYV9cdVz1cyjKHMGGio0HZgmEW6WWSerfEZ0iY56V/geVGI3XLQFsuPP0
RmeEZtmJC7+2K1agbky2XoE9X8hE/C27xmNftL9F8HfT1PD6hpUSZZmcdVIP5FgyMV8VUgFYaCbu
W3Q20KQ5FZ55f6xZy4Wy95LXxgsGcsP6mq5KGqfkDf0RNBfA2oyviOp7FceEkpKcZYYPh9Faw/2F
JacIt486eGpPkoJbS2prUJguD74301u2hsy5En/DoUEHfrD4uPTAgvDXjqVxjhpZ1O9H2cY2ToOJ
UH8h561bJDaZl8IJXER0CIu/CMZiXeTlA0d44/sjwYlAefQ3A1p7cSoze7wB25uiYNdWvJVMYdGt
xYU=
=H+YW
-----END PGP SIGNATURE-----

--------------doUI0mTwHSfffR0EQu0YAEVF--