diff options
| author | Eric M. Ludlam <zappo@gnu.org> | 2012-01-13 21:19:25 +0800 |
|---|---|---|
| committer | Chong Yidong <cyd@gnu.org> | 2012-01-13 21:19:25 +0800 |
| commit | 6e9ddbb313cf7db66550f93a74cbba12e39e93c0 (patch) | |
| tree | 75980dee1d1a454da12d6fdd4b377a0e915dad61 /lisp/emacs-lisp/debug.el | |
| parent | e517eda4d0d6da5d4b8f12be1608fb5e17c455ff (diff) | |
| parent | a62d5ee188dcb532088a15b0a2f066d3305b2eda (diff) | |
| download | emacs-6e9ddbb313cf7db66550f93a74cbba12e39e93c0.tar.gz emacs-6e9ddbb313cf7db66550f93a74cbba12e39e93c0.tar.bz2 emacs-6e9ddbb313cf7db66550f93a74cbba12e39e93c0.zip | |
Fix EDE security flaw involving loading arbitrary Lisp from Project.ede.
* lisp/ede.el (ede-project-directories): New option.
(ede-directory-safe-p): Check it.
(ede-initialize-state-current-buffer, ede, ede-new)
(ede-check-project-directory, ede-rescan-toplevel)
(ede-load-project-file, ede-parent-project, ede-current-project):
(ede-target-parent): Avoid loading in a project unless it is safe,
since it may involve malicious code. This security flaw was
pointed out by Hiroshi Oota.
* lisp/ede/auto.el (ede-project-autoload): Add safe-p slot.
(ede-project-class-files): Projects using Project.ede are unsafe.
(ede-auto-load-project): New method.
* lisp/ede/simple.el (ede-project-class-files): Mark as unsafe.
Diffstat (limited to 'lisp/emacs-lisp/debug.el')
0 files changed, 0 insertions, 0 deletions