pkg/60711: editors/emacs29: backport the CVE-2025-1244 fix to man.el

["zakinko%snowrabbit.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60711
>Category:       pkg
>Synopsis:       editors/emacs29: backport the CVE-2025-1244 fix to man.el
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 10 22:20:00 +0000 2026
>Originator:     Showta Ishizaki
>Release:        pkgsrc CVS as of 2026-09-10, editors/emacs29/Makefile,v 1.48
>Organization:
>Environment:
System: NetBSD 11.0 amd64, FreeBSD 15.1-RELEASE-p3, GhostBSD 26.1
(FreeBSD 15.0-RELEASE-p10 base), OpenBSD 7.9 amd64, DragonFly 6.4-RELEASE
x86_64
Architecture: x86_64
>Description:
	Man-getpage-in-background runs the man command under sh -c and
	formats the page name into it, so whatever Man-translate-references
	returns reaches a shell.  A reference with no section part is
	returned unchanged, so "M-x man RET ;id RET" runs id.  This is
	CVE-2025-1244, upstream commit 820f0793f0 ("Fix man.el shell
	injection vulnerability"), debbugs 66390.

	The fix landed only in 30.1.  editors/emacs29 stays on 29.4, and
	pkg_admin audit says nothing about it:

	  # pkg_admin audit-pkg emacs29-29.4
	  (nothing)
	  # pkg_admin audit-pkg emacs29-29.3
	  Package emacs29-29.3 has a command-injection vulnerability, ...
	  CVE-2025-1244

	pkg-vulnerabilities has "emacs29<29.4.0" for this, and 29.4 and
	29.4.0 compare equal under dewey ordering, so the entry never
	matches anything -- pkg_admin audit says nothing about 29.4 whether
	or not this patch goes in.  Changing it to "emacs29<29.4.1" would
	at least make it match the 29.4 that is actually distributed; once
	this patch is applied, it could be narrowed further to exclude the
	fixed PKGREVISION, but I'll leave the exact form of that to whoever
	maintains the file.

>How-To-Repeat:
	Load the packaged lisp/man.el and check what it returns:

	  (require 'man)
	  (Man-translate-references ";id")

	29.4 returns ";id" unchanged, which is the argument that reaches
	sh -c.  30.1 returns "\;id".

>Fix:
	Measured on five platforms.  The built emacs was asked for
	Man-translate-references ";id", against a control run that loaded
	the unpatched 29.4 man.el into the same binary:

	  NetBSD 11.0/amd64         "\;id"   control ";id"
	  FreeBSD 15.1-RELEASE-p3   "\;id"   control ";id"
	  GhostBSD 26.1             "\;id"   control ";id"
	  OpenBSD 7.9/amd64         "\;id"   control ";id"
	  DragonFly 6.4-RELEASE     "\;id"   control ";id"

	man.elc carries shell-quote-argument on all five, so the patch is
	in the byte code that actually runs, not only in the source.

	patches/patch-lisp_man.el is a new file, so it needs "cvs add"
	after the diff is applied. The diff below applies cleanly to a
	fresh checkout of editors/emacs29 (verified with patch -p0), and
	the SHA1 in distinfo is for the new file with the $NetBSD$ line
	still unexpanded, which is what pkgsrc computes it against.

	The five-platform table above is from a local fork with the same
	patch body but a different tree layout. Separately, I applied this
	exact diff to a fresh CVS checkout of editors/emacs29 and built
	emacs29-nox11 from it on NetBSD 11.0/amd64: "make package" succeeds,
	and the resulting binary returns "\;id" for the same call, while a
	control run that loads the unpatched man.el into the same binary
	still returns ";id".

	Index: Makefile
	===================================================================
	RCS file: /cvsroot/pkgsrc/editors/emacs29/Makefile,v
	retrieving revision 1.48
	diff -u -u -r1.48 Makefile
	--- Makefile	2 Sep 2026 19:01:47 -0000	1.48
	+++ Makefile	10 Sep 2026 16:52:57 -0000
	@@ -2,7 +2,7 @@
	 
	 CONFLICTS+=	emacs29-nox11-[0-9]*
	 
	-PKGREVISION= 	30
	+PKGREVISION= 	31
	 
	 .include "../../editors/emacs29/Makefile.common"
	 
	Index: distinfo
	===================================================================
	RCS file: /cvsroot/pkgsrc/editors/emacs29/distinfo,v
	retrieving revision 1.5
	diff -u -u -r1.5 distinfo
	--- distinfo	22 Dec 2025 19:51:06 -0000	1.5
	+++ distinfo	10 Sep 2026 16:52:57 -0000
	@@ -4,4 +4,5 @@
	 SHA512 (emacs-29.4.tar.xz) = 66b38081cb01d2c46ff7beefb45986cc225b4c922c30712ad0d456c6cae5507176ed99418c8f26948c5375c8afde4e4b2507d23ed997dbb5392d12150a121d80
	 Size (emacs-29.4.tar.xz) = 52210344 bytes
	 SHA1 (patch-Makefile.in) = cb43792c8996c781f382ae102ea771af8f3d3190
	+SHA1 (patch-lisp_man.el) = 31f79fdca013bfb725d82877263ca1ebe16505f5
	 SHA1 (patch-src_treesit.c) = f58370000074137997b8119ab55f49f2964010bb
	Index: patches/patch-lisp_man.el
	===================================================================
	RCS file: patches/patch-lisp_man.el
	diff -N patches/patch-lisp_man.el
	--- /dev/null	1 Jan 1970 00:00:00 -0000
	+++ patches/patch-lisp_man.el	10 Sep 2026 16:51:06 -0000
	@@ -0,0 +1,24 @@
	+$NetBSD$
	+
	+Man-getpage-in-background runs the man command under sh -c, and passes
	+whatever Man-translate-references returns straight into it.  A reference
	+with no section part is returned unchanged, so "M-x man RET ;id RET" runs
	+id.  Fix from upstream commit 820f0793f0 ("Fix man.el shell injection
	+vulnerability"), debbugs 66390, landed only in 30.1; this package stays on
	+29.4.
	+
	+--- lisp/man.el.orig
	++++ lisp/man.el
	+@@ -684,7 +684,11 @@
	+       (setq name (match-string 2 ref)
	+ 	    section (match-string 1 ref))))
	+     (if (string= name "")
	+-	ref				; Return the reference as is
	++        ;; see Bug#66390
	++	(mapconcat 'identity
	++                   (mapcar #'shell-quote-argument
	++                           (split-string ref "\\s-+"))
	++                   " ")                 ; Return the reference as is
	+       (if Man-downcase-section-letters-flag
	+ 	  (setq section (downcase section)))
	+       (while slist