From: Max Nikulin <manikulin@gmail.com>
To: emacs-orgmode@gnu.org
Subject: [PATCH] test-org-macro.el: Add test for CVE-2024-30202 (was: Re: [ANN] Emergency bugfix release: Org mode 9.6.23)
Date: Mon, 6 May 2024 19:23:47 +0700 [thread overview]
Message-ID: <v1ai4j$s43$1@ciao.gmane.io> (raw)
In-Reply-To: <871q7zbldp.fsf@localhost>
[-- Attachment #1: Type: text/plain, Size: 278 bytes --]
On 25/03/2024 00:16, Ihor Radchenko wrote:
>
> I just released Org mode 9.6.23 that fixes several critical
> vulnerabilities.
Since a variant of exploit has been published, it is time to add a test
that might prevent code change re-introducing the most severe vulnerability.
[-- Attachment #2: 0001-test-org-macro.el-Add-test-for-CVE-2024-30202.patch --]
[-- Type: text/x-patch, Size: 1308 bytes --]
From af8cddb44f5ee01fb1c7c9cf664ddbc83c63ac56 Mon Sep 17 00:00:00 2001
From: Max Nikulin <manikulin@gmail.com>
Date: Mon, 6 May 2024 19:04:17 +0700
Subject: [PATCH] test-org-macro.el: Add test for CVE-2024-30202
* testing/lisp/test-org-macro.el (test-org-macro/initialize-templates):
A new test that no code is evaluated when an Org file is opened
(CVE-2024-30202).
Ihor Radchenko [ANN] Emergency bugfix release: Org mode 9.6.23.
Sun, 24 Mar 2024 17:16:50 +0000.
<https://list.orgmode.org/871q7zbldp.fsf@localhost>
---
testing/lisp/test-org-macro.el | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/testing/lisp/test-org-macro.el b/testing/lisp/test-org-macro.el
index 3339945fa..88a51693c 100644
--- a/testing/lisp/test-org-macro.el
+++ b/testing/lisp/test-org-macro.el
@@ -22,6 +22,16 @@ ;;; Code:
\f
;;; Macros
+(ert-deftest test-org-macro/initialize-templates ()
+ "Test `org-macro-initialize-templates'."
+ ;; No code is executed during loading of Org mode files."
+ (should
+ (org-test-with-temp-text
+ "#+MACRO: title (eval (eval-and-compile (error \"CVE-2024-30202\")))"
+ (progn
+ (org-macro-initialize-templates)
+ t))))
+
(ert-deftest test-org/macro-replace-all ()
"Test `org-macro-replace-all' specifications."
;; Standard test.
--
2.39.2
next prev parent reply other threads:[~2024-05-06 12:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-24 17:16 [ANN] Emergency bugfix release: Org mode 9.6.23 Ihor Radchenko
2024-03-24 17:49 ` Bastien Guerry
2024-05-06 12:23 ` Max Nikulin [this message]
2024-05-06 12:58 ` [PATCH] test-org-macro.el: Add test for CVE-2024-30202 (was: Re: [ANN] Emergency bugfix release: Org mode 9.6.23) Ihor Radchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.orgmode.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='v1ai4j$s43$1@ciao.gmane.io' \
--to=manikulin@gmail.com \
--cc=emacs-orgmode@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).