Re: Fixing security vulnerabilities before new releases

Eshel Yaron <[email protected]> writes:

>> I can reproduce with emacs -Q, but not with my config. No
>> trust-manager-mode here.
>>
>> I'm on igc HEAD (397afb025b9).
>
> Thanks for checking.  I'm curious to hear which setting
> in your config affects it, if you figure it out.
>
> BTW, I see that Stefan just pushed some changes to master that
> (among other things) mitigate this vulnerability.
> The Emacs 31 release branch is still vulnerable though.

Well, it turns out that it is not a config issue.

If I create the test file with an Emacs instance, kill the buffer and
visit the file, the problem does not happen. The problem does not happen
even if I visit another identical file under a different name. To
clarify:

$ emacs

create a buffer foo.el and save the file

C-x k foo.el

C-x C-f foo.el. No Gotcha.

$ cp foo.el blah.el

C-x C-f blah.el. No Gotcha.

C-x C-c

$ emacs

C-x C-f foo.el. Gotcha (before the buffer is displayed), answer yes.

C-x k foo.el

C-x C-f foo.el again. No Gotcha.

C-x C-f blah.el. No Gotcha. I find this suprising.

C-x C-c

$ emacs

C-x C-f foo.el, Gotcha, press C-g.

the buffer is loaded, but not displayed.

C-x C-f foo.el. The buffer is displayed. With my config, after a few
seconds, Gotcha. Answer yes.

C-x C-f blah.el. No Gotcha.

C-x C-c

$ emacs -Q

C-x C-f foo.el. Gotcha. Press C-g.

C-x C-f foo.el. No Gotcha. Buffer is displayed. Answer yes.

C-x C-f blah.el. Gotcha.



So it seems that completing or aborting the yes-or-no-p affects the
behavior when a *different* file is visited with the same exploit,
depending on the configuration.