bug#66390: `man' allows to inject arbitrary shell code

[lux]

On Tue, 2023-10-10 at 17:54 +0700, Max Nikulin wrote:
> On 09/10/2023 23:30, lux wrote:
> > 
> > Here's my patch and the test cases.
> 
> Thank you for your attempt to fix the issue. Unfortunately the proposed 
> patch breaks the following case
> 
>     M-x man RET -k man RET
> 
> That is why I wrote that each word should escaped independently.
> 
> I am unsure if (man "-k man") should be supported as call with argument.
> 
> 
> 

Thanks for the correction :-)

I am fix my patch, and test on Emacs 30.0.50 it's ok.

Stefan, Max, can you test it again?

0001-Fix-man.el-code-injection-vulnerability.patch
Description: Text Data