On 25/03/2024 00:16, Ihor Radchenko wrote:
I just released Org mode 9.6.23 that fixes several critical vulnerabilities.
Since a variant of exploit has been published, it is time to add a test that might prevent code change re-introducing the most severe vulnerability.
From af8cddb44f5ee01fb1c7c9cf664ddbc83c63ac56 Mon Sep 17 00:00:00 2001 From: Max Nikulin <maniku...@gmail.com> Date: Mon, 6 May 2024 19:04:17 +0700 Subject: [PATCH] test-org-macro.el: Add test for CVE-2024-30202 * testing/lisp/test-org-macro.el (test-org-macro/initialize-templates): A new test that no code is evaluated when an Org file is opened (CVE-2024-30202). Ihor Radchenko [ANN] Emergency bugfix release: Org mode 9.6.23. Sun, 24 Mar 2024 17:16:50 +0000. <https://list.orgmode.org/871q7zbldp.fsf@localhost> --- testing/lisp/test-org-macro.el | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/testing/lisp/test-org-macro.el b/testing/lisp/test-org-macro.el index 3339945fa..88a51693c 100644 --- a/testing/lisp/test-org-macro.el +++ b/testing/lisp/test-org-macro.el @@ -22,6 +22,16 @@ ;;; Code: ;;; Macros +(ert-deftest test-org-macro/initialize-templates () + "Test `org-macro-initialize-templates'." + ;; No code is executed during loading of Org mode files." + (should + (org-test-with-temp-text + "#+MACRO: title (eval (eval-and-compile (error \"CVE-2024-30202\")))" + (progn + (org-macro-initialize-templates) + t)))) + (ert-deftest test-org/macro-replace-all () "Test `org-macro-replace-all' specifications." ;; Standard test. -- 2.39.2
