Re: emacs-29 3c1693d08b0: Fix Elisp code injection vulnerability in emacsclient-mail.desktop

[Po Lu]

Ulrich Mueller <ulm@gentoo.org> writes:

> Then the desktop file won't work, obviously. The problem is that
> ${PARAMETER//PATTERN/STRING} substitution is not available in POSIX
> parameter expansion. So with POSIX sh, an external program (e.g. sed)
> would have to be called.
>
> The long term solution (suggested by Stefan Monnier) might be to add
> a --funcall option to emacsclient. Then there would be no need for a
> shell wrapper, in the first place.
>
> Should the Makefile skip installation of emacsclient-mail.desktop
> when bash isn't available on the system?

Could we install this change not on emacs-29, but on master?

I don't think the problem it solves is severe, nor a regression from
Emacs 28.  It is rather a minor nusiance with certain URLs.