From 09364e5a91d6bed58797cd936a2f63edd399deec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vojt=C4=9Bch=20K=C3=A1n=C4=9B?= Date: Thu, 22 May 2025 10:42:20 +0200 Subject: [PATCH] aerc: backport an upstream patch for handling of attachments' filenames The patch is not part of a tagged release yet so we apply it selectively instead of upgrading whole aerc. While it is originally presented as a usability problem only for attachments with absolutes filepaths (they fail to open), there is nothing stopping you from putting a relative path in there therefore forcing aerc to overwriting any path on the host system with sender chosen data. It's been marked as CVE-2025-49466 I decided to inline the patches into nixpkgs as they are very short and the current bot protection of git.sr.ht complicates patch fetching. (cherry picked from commit a8b64551c5f11f7fe4700c94d50758b4c1baf5d3) --- .../ae/aerc/basename-temp-file-fixup.patch | 34 +++++++++++++++ pkgs/by-name/ae/aerc/basename-temp-file.patch | 41 +++++++++++++++++++ pkgs/by-name/ae/aerc/package.nix | 5 +++ 3 files changed, 80 insertions(+) create mode 100644 pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch create mode 100644 pkgs/by-name/ae/aerc/basename-temp-file.patch diff --git a/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch b/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch new file mode 100644 index 000000000000..07bec5bffbd8 --- /dev/null +++ b/pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch @@ -0,0 +1,34 @@ +From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001 +From: Nicole Patricia Mazzuca +Date: Fri, 9 May 2025 09:32:21 +0200 +Subject: [PATCH] open: fix opening text/html messages + +This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329: +aerc started using `path.Base()`, which returns `"."` on an empty +path, but still checked for `""` two lines later. + +On macOS, the result is that aerc attempts to open the directory: + +``` +open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory +``` + +Signed-off-by: Nicole Patricia Mazzuca +Acked-by: Robin Jarry +--- + commands/msgview/open.go | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/commands/msgview/open.go b/commands/msgview/open.go +index a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3..7c770d4a90b771e3a18dfcb327f5e9306d5b5fa7 100644 +--- a/commands/msgview/open.go ++++ b/commands/msgview/open.go +@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error { + } + filename := path.Base(part.FileName()) + var tmpFile *os.File +- if filename == "" { ++ if filename == "." { + extension := "" + if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 { + extension = exts[0] diff --git a/pkgs/by-name/ae/aerc/basename-temp-file.patch b/pkgs/by-name/ae/aerc/basename-temp-file.patch new file mode 100644 index 000000000000..8ca81c21db95 --- /dev/null +++ b/pkgs/by-name/ae/aerc/basename-temp-file.patch @@ -0,0 +1,41 @@ +From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001 +From: Robin Jarry +Date: Wed, 9 Apr 2025 10:49:24 +0200 +Subject: [PATCH] open: only use part basename for temp file + +When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf", +aerc creates a temp folder and tries to store the file by blindly +concatenating the path as follows: + + /tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf + +And when writing to this path, it gets a "No such file or directory" +error because the intermediate "tmp" subfolder isn't created. + +Reported-by: Erik Colson +Signed-off-by: Robin Jarry +--- + commands/msgview/open.go | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/commands/msgview/open.go b/commands/msgview/open.go +index 4293b7e4892c137a7f3fbbe79245ffb6733b2671..a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3 100644 +--- a/commands/msgview/open.go ++++ b/commands/msgview/open.go +@@ -5,6 +5,7 @@ import ( + "io" + "mime" + "os" ++ "path" + "path/filepath" + + "git.sr.ht/~rjarry/aerc/app" +@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error { + app.PushError(err.Error()) + return + } +- filename := part.FileName() ++ filename := path.Base(part.FileName()) + var tmpFile *os.File + if filename == "" { + extension := "" diff --git a/pkgs/by-name/ae/aerc/package.nix b/pkgs/by-name/ae/aerc/package.nix index 4fae126d3c0d..3e4bc122bbe9 100644 --- a/pkgs/by-name/ae/aerc/package.nix +++ b/pkgs/by-name/ae/aerc/package.nix @@ -39,6 +39,11 @@ buildGoModule rec { url = "https://git.sr.ht/~rjarry/aerc/commit/7346d20.patch"; hash = "sha256-OCm8BcovYN2IDSgslZklQxkGVkSYQ8HLCrf2+DRB2mM="; }) + + # TODO remove these with the next release + # they resolve a path injection vulnerability when saving attachments (CVE-2025-49466) + ./basename-temp-file.patch + ./basename-temp-file-fixup.patch ]; postPatch = ''