Re: emacs-29 3c1693d08b0: Fix Elisp code injection vulnerability in emacsclient-mail.desktop

[Eli Zaretskii]

> From: Robert Pluim <rpluim@gmail.com>
> Cc: Po Lu <luangruo@yahoo.com>,  emacs-devel@gnu.org
> Date: Wed, 08 Mar 2023 11:37:06 +0100
> 
> Itʼs certainly not a regression, but it is fairly serious. We could
> mitigate it somewhat by adding '--funcall', I guess.
> 
> The last time --funcall was discussed, there was no consensus on how
> arguments should be handled, so Iʼve just gone ahead and implemented
> one variant. We could add any restrictions we like on the server side,
> it currently just disallows direct `eval'
> 
> Not for emacs-29, I think.

Indeed, not for emacs-29.  So if requiring Bash is not going to fly,
we need to find a different way to fix the original problem.  Adding a
general-purpose command-line option to emacsclient, which also
requires a change in the client-server protocol, is out of the
question for emacs-29.