xterm/xterm-forbid_window_and_font_ops.patch

34 lines
1.1 KiB
Diff
Raw Normal View History

Accepting request 631631 from home:pcerny:factory - Patch #335 - 2018/08/14 * add colorInnerBorder resource to make a change from patch #334 configurable (reports by H Merijn Brand, Gabriele Balducci). - Patch #334 - 2018/08/12 * modify Imakefile to reflect the fact that NetBSD no longer has a working termcap emulation. * add resource-setting validShells which can be used to augment the system's /etc/shell (prompted by discussion with Paul Lampert). * stifle some useless warnings from lintian in test-packages. * add the ncurses extension “RGB” to the responses for the termcap-query feature. * improved getopts-handling in sample scripts. * fix some warnings from gcc8 and clang --analyze. * update note about incorrect documentation for DECRQSS to include VT525 (report by Markus Schmidt). * correct check for default-values in rectangular parsing; a zero counts as a missing or default parameter (report/testcase by Markus Schmidt). * correct some ranges in the ambiguous[] table in wcwidth (adapted from patch by KUGA Tsutomu). * fix a special case with faint video attribute incorrectly combined with default color. * add private control XTREPORTSGR for reporting video-attributes and color on a rectangle, and script report-sgr.pl to demonstrate it. * modify some of the markup in ctlseqs.ms to work around groff's reassignment of ASCII punctuation characters as documented in groff_char(7). OBS-URL: https://build.opensuse.org/request/show/631631 OBS-URL: https://build.opensuse.org/package/show/X11:terminals/xterm?expand=0&rev=158
2018-08-26 23:45:34 +02:00
# HG changeset patch
# Parent d5ffae3ffb4d7bccf09feb476eed67e7688d73cf
# forbid dangerous escape sequences (font loading)
2023-10-03 16:04:15 +02:00
Index: xterm-385/XTerm.ad
===================================================================
--- xterm-385.orig/XTerm.ad
+++ xterm-385/XTerm.ad
@@ -269,6 +269,11 @@
! Alternatively,
!*on2Clicks: regex [[:alpha:]]+://([[:alnum:]!#+,./=?@_~-]|(%[[:xdigit:]][[:xdigit:]]))+
+! Security: Disallow operations that might allow raw text being pasted to xterm to
+! execute code.
+*allowWindowOps: false
+*allowFontOps: false
+
!! We want a 8bit clean xterm
*eightBitInput: true
*eightBitOutput: true
2023-10-03 16:04:15 +02:00
Index: xterm-385/xterm.man
===================================================================
--- xterm-385.orig/xterm.man
+++ xterm-385/xterm.man
@@ -2277,7 +2277,7 @@ The default is \*(``true\*(''.
.TP
2016-10-08 18:43:48 +02:00
.B "allowFontOps\fP (class\fB AllowFontOps\fP)"
Specifies whether control sequences that set/query the font should be allowed.
-The default is \*(``true\*(''.
+The default is \*(``false\*(''.
2017-09-22 14:05:44 +02:00
.TP
.B "allowMouseOps\fP (class\fB AllowMouseOps\fP)"
Specifies whether control sequences that enable \fI\*n\fP to send