Update of bug #68688 (group groff):
Status: In Progress => Fixed
Privacy: Private => Public
Open/Closed: Open => Closed
_______________________________________________________
Follow-up Comment #17:
commit e8613792630f957a9ad105c2d7f9c6e56f34f4de
Author: G. Branden Robinson <[email protected]>
Date: Mon Sep 28 10:20:55 2026 -0500
[pre-grohtml]: Regression-test Savannah #68688.
* src/preproc/html/tests/does-not-defeat-safer-mode.sh: Do it.
* src/preproc/html/html.am (pre_grohtml_TESTS): Run test.
(TESTS, EXTRA_DIST): Wire `pre_grohtml_TESTS` into Automake test
harness and ship this and any future pre-grohtml test scripts.
Test fails at this commit.
commit 82ab38c6c76c66ddea190114e12a52e9644479fe
Author: G. Branden Robinson <[email protected]>
Date: Wed Sep 23 12:27:22 2026 -0500
[troff]: Fix Savannah #68688 (1/2).
* src/roff/troff/input.cpp (do_suppress): Reject `\O5` output
suppression escape sequence if it contains shell-unsafe characters in
the file name portion of its argument, to advise user of limitation of
pre-grohtml(1) preprocessor.
Fixes <https://savannah.gnu.org/bugs/?68688> (1/2). While blindly
passing shell-unsafe characters via the `\O5` escape sequence is not
_itself_ an avenue for command injection, the only _consumer_ of such
escape sequences is the pre-grohtml preprocessor (which is vulnerable),
so performing strict input validation here makes sense.
commit cbed1f24d169267a8981afee7b44692b8d7ce92d
Author: G. Branden Robinson <[email protected]>
Date: Wed Sep 23 12:41:47 2026 -0500
[grohtml]: Fix Savannah #68688 (2/2).
* src/preproc/html/pre-html.cpp (imageList::createImage): Fix command
injection vulnerability by rejecting shell-significant syntax
characters in raster image file names.
Fixes <https://savannah.gnu.org/bugs/?68688> (2/2). Problem appears
to date back to commit a0fae9edb7, 2001-01-07, the initial check-in of
the pre-grohtml preprocessor, which first shipped in groff 1.17.
Thanks to Pavol Sloboda for the report and a reproducer.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68688>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
