Bug#1144011: trixie-pu: package kakoune/2024.05.18-2+deb13u1

Peter Pentchev <[email protected]> Sun, 9 Aug 2026 20:50:59 +0300

Newsgroups	gmane.linux.debian.devel.release
Message-ID	<178629779012.611139.10430503143976635207.reportbug__29918.8045713649$1786298010$gmane$org@straylight.m.ringlet.net>

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:kakoune
User: [email protected]
Usertags: pu

This is a future unblock request for a no-DSA security fix to
the kakoune source package.

[ Reason ]
As discussed in #1143968, there is a security issue that is not
triggered by a default setup, but it may still affect Debian
users of kakoune who have activated the autorestore functionality.

[ Impact ]
A security fix will not be present in the trixie version of kakoune.

[ Tests ]
The upstream commit that has been added as the CVE-2026-48120 patch
indeed involves an addition to the build- and autopkgtest-time
test suite that makes sure the fix works.

[ Risks ]
The change in the shell part of the kakoune autorestore tool is
relatively simple. It is limited in scope to only validating and
sanitizing filenames. As such, I believe the risk to be minimal.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Add the CVE-2026-48120 patch that makes the autorestore tool
validate the filenames it finds in the recorded files.

[ Other info ]
The issue is fixed in unstable by the just-uploaded 2026.05.21 new
upstream release.

kakoune_2024.05.18-2+deb13u1.debdiff (text/plain, 4.7 KB)

diff -Nru kakoune-2024.05.18/debian/changelog kakoune-2024.05.18/debian/changelog
--- kakoune-2024.05.18/debian/changelog	2024-09-03 16:47:12.000000000 +0300
+++ kakoune-2024.05.18/debian/changelog	2026-08-09 20:27:34.000000000 +0300
@@ -1,3 +1,9 @@
+kakoune (2024.05.18-2+deb13u1) trixie; urgency=medium
+
+  * Add the CVE-2026-48120 patch; Closes: #1143968
+
+ -- Peter Pentchev <[email protected]>  Sun, 09 Aug 2026 20:27:34 +0300
+
 kakoune (2024.05.18-2) unstable; urgency=medium
 
   * Fix FTBFS with debhelper 13.17 and later: we override dh_auto_install,
diff -Nru kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch
--- kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch	1970-01-01 02:00:00.000000000 +0200
+++ kakoune-2024.05.18/debian/patches/CVE-2026-48120.patch	2026-08-09 20:21:20.000000000 +0300
@@ -0,0 +1,82 @@
+Description: Fix escaping issues in autorestore.kak
+ Ensure filenames are escaped when echo'ed, and validate that we only
+ have posix portable characters (i.e. [A-Za-z0-9_.-]) as part of the
+ suffix, as mkstemp is specified to behave.
+Bug-Debian: https://bugs.debian.org/1143968
+Origin: upstream, https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825
+Author: Maxime Coste <[email protected]>
+Last-Update: 2026-08-09
+
+--- a/rc/tools/autorestore.kak
++++ b/rc/tools/autorestore.kak
+@@ -16,25 +16,30 @@
+     evaluate-commands %sh{
+         buffer_basename="${kak_buffile##*/}"
+         buffer_dirname=$(dirname "${kak_buffile}")
++        backup_prefix="${buffer_dirname}"/".${buffer_basename}.kak."
+ 
+         if [ -f "${kak_buffile}" ]; then
+-            newer=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
+-            older=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
++            newer=$(find "${backup_prefix}"* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
++            older=$(find "${backup_prefix}"* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
+         else
+             # New buffers that were never written to disk.
+-            newer=$(ls -1t "${buffer_dirname}"/".${buffer_basename}.kak."* 2>/dev/null | head -n 1)
++            newer=$(ls -1t "${backup_prefix}"* 2>/dev/null | head -n 1)
+             older=""
+         fi
+ 
+         if [ -z "${newer}" ]; then
+             if [ -n "${older}" ]; then
+-                printf %s\\n "
+-                    echo -debug Old backup file(s) found: will not restore ${older} .
+-                "
++                printf "echo -debug 'Old backup file(s) found: will not restore %s.'" "$(printf %s "${older}" | sed s/\'/\'\'/g)"
+             fi
+             exit
+         fi
+ 
++        # ensure backup suffix only contains portable filename characters
++        if ! pathchk -p "$(printf %s "${newer}" | cut -b ${#backup_prefix}-)" >/dev/null 2>&1; then
++            printf "echo -debug 'backup file suffix contains unexpected characters %s, ignored.'" "$(printf %s "${newer}" | sed s/\'/\'\'/g)"
++            exit
++        fi
++
+         printf %s\\n "
+             ## Replace the content of the buffer with the content of the backup file
+             echo -debug Restoring file: ${newer}
+--- /dev/null
++++ b/test/tools/autorestore/autorestore/env
+@@ -0,0 +1,3 @@
++BACKUP='.out.kak.AABBCC'
++echo BACKUP > "$BACKUP"
++while [ ! "$BACKUP" -nt out ]; do touch "$BACKUP"; done
+--- /dev/null
++++ b/test/tools/autorestore/autorestore/out
+@@ -0,0 +1 @@
++BACKUP
+--- /dev/null
++++ b/test/tools/autorestore/autorestore/rc
+@@ -0,0 +1,2 @@
++source "%val{runtime}/rc/tools/autorestore.kak"
++autorestore-restore-buffer
+--- /dev/null
++++ b/test/tools/autorestore/check-portable-character-set/env
+@@ -0,0 +1,3 @@
++BACKUP='.out.kak.;"foo"'
++echo BACKUP > "$BACKUP"
++while [ ! "$BACKUP" -nt out ]; do touch "$BACKUP"; done
+--- /dev/null
++++ b/test/tools/autorestore/check-portable-character-set/in
+@@ -0,0 +1 @@
++TEST
+--- /dev/null
++++ b/test/tools/autorestore/check-portable-character-set/out
+@@ -0,0 +1 @@
++TEST
+--- /dev/null
++++ b/test/tools/autorestore/check-portable-character-set/rc
+@@ -0,0 +1,2 @@
++source "%val{runtime}/rc/tools/autorestore.kak"
++autorestore-restore-buffer
diff -Nru kakoune-2024.05.18/debian/patches/series kakoune-2024.05.18/debian/patches/series
--- kakoune-2024.05.18/debian/patches/series	2024-09-03 16:47:12.000000000 +0300
+++ kakoune-2024.05.18/debian/patches/series	2026-08-09 20:19:51.000000000 +0300
@@ -5,3 +5,4 @@
 07-readme-listing.patch
 08-optimize.patch
 09-parallel-dirs.patch
+CVE-2026-48120.patch

signature.asc (application/pgp-signature, 833 B)