[From nobody Sun Oct 18 12:37:07 2026 Received: (at submit) by bugs.debian.org; 20 Mar 2021 14:56:27 +0000 X-Spam-Checker-Version: SpamAssassin 3.4.2-bugs.debian.org_2005_01_02 (2018-09-13) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=4.0 tests=BAYES_00,DIGITS_LETTERS, DKIM_SIGNED,DKIM_VALID,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, HAS_PACKAGE,MURPHY_DRUGS_REL8,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 42; hammy, 150; neutral, 52; spammy, 0. spammytokens: hammytokens:0.000-+--Lintian, 0.000-+--lintian, 0.000-+--gmxnet, 0.000-+--gmx.net, 0.000-+--HX-UI-Sender-Class:sk:01bb95c Return-path: <marriott99@gmx.com> Received: from mout.gmx.net ([212.227.17.22]:54563) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <marriott99@gmx.com>) id 1lNd1f-0005Lw-9T for submit@bugs.debian.org; Sat, 20 Mar 2021 14:56:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1616252184; bh=zeSEp2oZqrV14O5eXTR+m6NjW1zwwz3VZAmBNI7aHA0=; h=X-UI-Sender-Class:From:To:Subject:Date; b=Jq90hOK03JMUiyT0DwkKJevNjSYjH5wyw7BB+HkI32aI9h1G+WJhP71BpoXkGXTvF Tgdn5GZb4enl32aJIE8Ob3qzfwI12l1yS3YpfKoziwMiW/NS5WgGb8ZZBl7WC7UhOH 92/ige9dZRlVbRYMGvh8Kgm4bfui15NT5tv82jqo= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [87.14.159.89] ([87.14.159.89]) by web-mail.gmx.net (3c-app-mailcom-bs09.server.lan [172.19.170.177]) (via HTTP); Sat, 20 Mar 2021 15:56:24 +0100 MIME-Version: 1.0 Message-ID: <trinity-4ca29228-b3e8-4816-8ee1-03bac765a043-1616252184009@3c-app-mailcom-bs09> From: Marriott NZ <marriott99@gmx.com> To: submit@bugs.debian.org Subject: freeplane has mailcap entries with quoted %-escapes Content-Type: multipart/mixed; boundary=rekceb-f23f6464-7e39-4794-b954-14e399e1249e Date: Sat, 20 Mar 2021 15:56:24 +0100 Importance: normal Sensitivity: Normal X-Priority: 3 X-Provags-ID: V03:K1:WmJlnVihKwJ/U+1LdkQ2gwoPIfQT8TFaTzX8GXQvGa2eaZDp4mnrKTE7riF9wHG/A1epp yq1BO8OaVJICNYHKF1juIfn2vg+ouEUCyay4wm8tArybj9ocWkKNpo2wuasGcwHcYCqVJ9Z/NrP5 e8lXSp4WNIzeBUTymwV5WiZ/SUVBjKgJjtRo0NgE1N84+kg81P0HX7BOLwxCVAdpCYpnLej0FYvB TPAfwLBRWSyH7VZjOyqvmyL66M525OMWl8MX6yU8aAy7AXTB1BGCCYBVnPF6bCyH+VcjEqiQPHuy bU= X-UI-Out-Filterresults: notjunk:1;V03:K0:lZFocvAu4n4=:p95oiMUQ9YA3S+Pcpxzkhp AILIRTYmf+U4eQNCZX65lLSzHw+gV4uOMLTvi03W07urzYW8XgeYRwGr4vaGbfWhB1yVx4Ozv SHHdRRF/jQWYa+XtkjBHl1UH0kuwwnTyy0RBFbwuQJQD7A694bRVFo6Pw4BIo795Miga0MvTf vUMAAnACiL8ZBNAdD+lyVYmAcD/sFXTnBcf9l+Et6u9Ubz+lNomkriF3E4fIbJ/0Sq1WkMaPW AKs9RizlpIJn4SF9LCvkiXCwzLb1yNbCmdxSl4jxiI3DIeWZ9ozgJElpnmMidge+WZ9Z8jbBW C8m94eOx58k4A6uJTjMVgiW5mA7uK3gc4qBG/FjE2Ol64kLecV4GCNPn9nDLFuhBSKhNmhW9b DnKQPkeAf01nkkda0L6E9lrp+oDMOl1Qc0a+yg5GKfzpLOHMUX4psQn2BvtbiHdm78l2dcNdY GR9Cicoj3pu98Nw50LiV12oRinqg63vEj2XUNMidKZll341kr/Duw8yEJm+8+mH0xMS/HlJJ5 16GMJdFZ+1+7H7GSFMoBmx9UxJO1kncm/BdkIaGoDniVcds9SH/0KZGGaj9p+0MDFS9c386YF OZpi/Nbvc16vE= Delivered-To: submit@bugs.debian.org --rekceb-f23f6464-7e39-4794-b954-14e399e1249e Content-Type: text/plain; charset=UTF-8 Package: freeplane Version: 1.7.10-1 Tags: patch, security Dear Maintainer, the freeplane package has mailcap entries with quoted %-escapes. That is considered unsafe. Proper escaping should be left to the programs using the entry. This Lintian tag is triggered: https://lintian.debian.org/tags/quoted-placeholder-in-mailcap-entry.html See also grave bug #930908, which was recently closed because "a Lintian test already exists": https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930908 I'm using the "security" tag because the affected rules in combination with certain mail user agents (or document openers) are the cause of a shell command injection vulnerability. If you need more information let me know. Thanks, MNZ --rekceb-f23f6464-7e39-4794-b954-14e399e1249e Content-Type: text/x-patch Content-Disposition: attachment; filename=freeplane.diff Content-Transfer-Encoding: quoted-printable diff --git a/debian/freeplane.mime b/debian/freeplane.mime index 77b493e..78a6b35 100644 =2D-- a/debian/freeplane.mime +++ b/debian/freeplane.mime @@ -8,4 +8,4 @@ # magic, and so if both programs are installed, the correct program is us= ed # for the correct magic (i.e. <map version=3D"freeplane... vs <map>) in G= NOME/KDE/Xfce! -application/x-freemind; /usr/bin/freeplane '%s'; test=3Dtest -n "$DISPLAY= "; description=3D"Freeplane/FreeMind MindMap file"; textualnewlines; namet= emplate=3D%s.mm; priority=3D7 +application/x-freemind; /usr/bin/freeplane %s; test=3Dtest -n "$DISPLAY";= description=3D"Freeplane/FreeMind MindMap file"; textualnewlines; nametem= plate=3D%s.mm; priority=3D7 --rekceb-f23f6464-7e39-4794-b954-14e399e1249e-- ]