• Eli Zaretskii's avatar
    Disable execution of unsafe Lisp by Enriched Text mode · a103dbe3
    Eli Zaretskii authored
    * src/xdisp.c (handle_display_spec): If the display property is
    wrapped in 'disable-eval' form, disable Lisp evaluation while
    processing this property.
    (handle_single_display_spec): Accept new argument ENABLE_EVAL_P.
    If that argument is false, don't evaluate Lisp while processing
    display properties.
    
    * lisp/textmodes/enriched.el
    (enriched-allow-eval-in-display-props): New defcustom.
    (enriched-decode-display-prop): If
    enriched-allow-eval-in-display-props is nil, wrap the display
    property with 'disable-eval' to disable Lisp evaluation when the
    display property is processed for display.  (Bug#28350)
    * lisp/gnus/mm-view.el (mm-inline-text): Re-enable processing of
    enriched text.
    
    * doc/lispref/display.texi (Display Property): Document the
    'disable-eval' wrapping of 'display' properties.
    * doc/emacs/text.texi (Enriched Properties): Document
    'enriched-allow-eval-in-display-props'.
    
    * etc/NEWS: Describe the security issues with Enriched Text mode
    and their solution.
    a103dbe3
display.texi 307 KB