Re: Fixing security vulnerabilities before new releases

Stefan Monnier <[email protected]> writes:

>> @@ -299,7 +299,8 @@ vc-find-backend-function
>>    "Return BACKEND-specific implementation of FUN.
>>  If there is no such implementation, return the default implementation;
>>  if that doesn't exist either, return nil."
>> -  (let ((f (vc-make-backend-sym backend fun)))
>> +  (let* ((read-symbol-shorthands nil)   ; Mitigate CVE-2026-XXXXX
>> +         (f (vc-make-backend-sym backend fun)))
>>      (if (fboundp f) f
>>        ;; Load vc-BACKEND.el if needed.
>>        (require (intern (concat "vc-" (downcase (symbol-name backend)))))
>
> I'd move the let-binding to `vc-make-backend-sym` (i.e. to right around
> the relevant `intern` call).

That was my initial approach, but the above let-binding position also
protects that (require ATTACKER-CONTROLLED-SYMBOL) above, which seems
like a nice bonus. :)

> I'm sure there are other holes related to the over-enthusiastic use of
> `read-symbol-shorthands` in `intern`,

AFAICT, the VC attack vector (which you demonstrated) has the fewest
requirements to exploit, so it's the most important hole to close.
But yes, there are other similar risks.
(BTW, thank you for fixing these issues at their root on master!)

> so we could introduce an `intern--without-shorthands` and replace the
> few `intern` calls we see as risky.

SGTM.  Should I prepare a patch, or leave it you?


Best,

Eshel