Possible security problem -- File variables & `eval'

Article View: gnu.emacs.bug

Article #99649

#99649

From: Joseph C. Konczal
Date: Fri, 22 Jun 1990 16:19

23 lines
1400 bytes

Beware of mail or news messages containing local variables.  I sent
myself mail containing:

Local Variables:
eval: (hanoi 3)
End:

read my new mail, saved RMAIL, and killed the RMAIL buffer.  When I
ran rmail again, the Towers of Hanoi was automatically executed.  Here
is a patch for rmail.el that prevents local variables in a mail file
from being processed without your permission.

diff rmail.el.orig rmail.el
106c106,107
<   (let* ((file-name (expand-file-name (or file-name-arg rmail-file-name)))
---
>   (let* ((inhibit-local-variables t)
> 	 (file-name (expand-file-name (or file-name-arg rmail-file-name)))
386c387,388
< 	(find-file (buffer-file-name))
---
> 	((let ((inhibit-local-variables t)) 
> 	   find-file (buffer-file-name)))

Technical Details

Message-ID: <9006221619.AA01348@mail-gw.ncsl.nist.gov>

Path: arc1-ca.pugleaf.net!gmdzi!unido!mcsun!uunet!cs.utexas.edu!tut.cis.ohio-state.edu!MAIL-GW.NCSL.NIST.GOV!konczal

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fb2f1,3a0d70cd65e07cb9
X-Google-Attributes: gidfb2f1,public
X-Google-ArrivalTime: 1990-06-22 15:16:39 PST
Path: arc1-ca.pugleaf.net!gmdzi!unido!mcsun!uunet!cs.utexas.edu!tut.cis.ohio-state.edu!MAIL-GW.NCSL.NIST.GOV!konczal
From: konczal@MAIL-GW.NCSL.NIST.GOV (Joseph C. Konczal)
Newsgroups: gnu.emacs.bug
Subject: Possible security problem -- File variables & `eval'
Message-ID: <9006221619.AA01348@mail-gw.ncsl.nist.gov>
Date: 22 Jun 90 16:19:49 GMT
Sender: daemon@tut.cis.ohio-state.edu
Distribution: gnu
Organization: GNUs Not Usenet
Lines: 23
Posted: Fri Jun 22 17:19:49 1990