From f345d31b4239a47bc410c5d45027a7b5b46c7f68 Mon Sep 17 00:00:00 2001
From: Ulrich Müller <ulm@gentoo.org>
Date: Sun, 23 Jun 2024 11:41:41 +0200
Subject: 29.3: Backport org-mode fix from 29.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Ulrich Müller <ulm@gentoo.org>
---
 emacs/29.3/05_all_ol-expand-abbrev.patch | 58 ++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 emacs/29.3/05_all_ol-expand-abbrev.patch

diff --git a/emacs/29.3/05_all_ol-expand-abbrev.patch b/emacs/29.3/05_all_ol-expand-abbrev.patch
new file mode 100644
index 0000000..2aef76d
--- /dev/null
+++ b/emacs/29.3/05_all_ol-expand-abbrev.patch
@@ -0,0 +1,58 @@
+org-mode should not expand link abbrevs that specify an unsafe function
+Backported from emacs-29 branch
+
+commit c645e1d8205f0f0663ec4a2d27575b238c646c7c
+Author: Ihor Radchenko <yantar92@posteo.net>
+Date:   Fri Jun 21 15:45:25 2024 +0200
+
+    org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code
+
+--- emacs-29.3/lisp/org/ol.el
++++ emacs-29.3/lisp/org/ol.el
+@@ -1063,17 +1063,35 @@
+       (if (not as)
+ 	  link
+ 	(setq rpl (cdr as))
+-	(cond
+-	 ((symbolp rpl) (funcall rpl tag))
+-	 ((string-match "%(\\([^)]+\\))" rpl)
+-	  (replace-match
+-	   (save-match-data
+-	     (funcall (intern-soft (match-string 1 rpl)) tag))
+-	   t t rpl))
+-	 ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
+-	 ((string-match "%h" rpl)
+-	  (replace-match (url-hexify-string (or tag "")) t t rpl))
+-	 (t (concat rpl tag)))))))
++	;; Drop any potentially dangerous text properties like
++	;; `modification-hooks' that may be used as an attack vector.
++	(substring-no-properties
++	 (cond
++	  ((symbolp rpl) (funcall rpl tag))
++	  ((string-match "%(\\([^)]+\\))" rpl)
++	   (let ((rpl-fun-symbol (intern-soft (match-string 1 rpl))))
++	     ;; Using `unsafep-function' is not quite enough because
++	     ;; Emacs considers functions like `genenv' safe, while
++	     ;; they can potentially be used to expose private system
++	     ;; data to attacker if abbreviated link is clicked.
++	     (if (or (eq t (get rpl-fun-symbol 'org-link-abbrev-safe))
++		     (eq t (get rpl-fun-symbol 'pure)))
++		 (replace-match
++		  (save-match-data
++		    (funcall (intern-soft (match-string 1 rpl)) tag))
++		  t t rpl)
++	       (org-display-warning
++		(format "Disabling unsafe link abbrev: %s
++You may mark function safe via (put '%s 'org-link-abbrev-safe t)"
++			rpl (match-string 1 rpl)))
++	       (setq org-link-abbrev-alist-local (delete as org-link-abbrev-alist-local)
++		     org-link-abbrev-alist (delete as org-link-abbrev-alist))
++	       link
++	       )))
++	  ((string-match "%s" rpl) (replace-match (or tag "") t t rpl))
++	  ((string-match "%h" rpl)
++	   (replace-match (url-hexify-string (or tag "")) t t rpl))
++	  (t (concat rpl tag))))))))
+ 
+ (defun org-link-open (link &optional arg)
+   "Open a link object LINK.
-- 
cgit v1.2.3-65-gdbad