bug#66390: `man' allows to inject arbitrary shell code

[Max Nikulin]

On 11/01/2024 19:07, Ihor Radchenko wrote:
> Stefan Kangas writes:
>
> > OK, I've now installed the change on master (820f0793f0b).  I'm tagging
> > the bug "security" to make it easier to find for distro maintainers.
> >
> > Ihor, I'm copying in you as well, in case you want to add a workaround
> > for this security-relevant bug to Org mode as well.
[...]
> Fixed, on bugfix (for the next Org bugfix release).
> https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=bc3caa8f9

Ihor, I am confused by `org-man-store-link' call in

(if (org-man-store-link (equal (Man-translate-references ";id") "\\;id"))

Is it intentional? I hope, the following is not an issue:

(let ((system-type 'ms-dos))
  (shell-quote-argument ";id"))
"\";id\""

no "\\;id"