Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package emacs for openSUSE:Factory checked in at 2026-10-14 18:33:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/emacs (Old) and /work/SRC/openSUSE:Factory/.emacs.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "emacs" Wed Oct 14 18:33:31 2026 rev:227 rq:1384524 version:31.1 Changes: -------- --- /work/SRC/openSUSE:Factory/emacs/emacs.changes 2026-10-09 21:42:56.263154963 +0200 +++ /work/SRC/openSUSE:Factory/.emacs.new.3698736/emacs.changes 2026-10-14 18:34:03.933194329 +0200 @@ -1,0 +2,6 @@ +Thu Oct 8 12:50:35 UTC 2026 - Dr. Werner Fink <[email protected]> + +- Add patch emacs-bsc1284345.patch + * Fix incomplete fix for CVE-2026-79992 + +------------------------------------------------------------------- New: ---- emacs-bsc1284345.patch ----------(New B)---------- New: - Add patch emacs-bsc1284345.patch * Fix incomplete fix for CVE-2026-79992 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ emacs.spec ++++++ --- /var/tmp/diff_new_pack.yuCq9U/_old 2026-10-14 18:34:05.986281266 +0200 +++ /var/tmp/diff_new_pack.yuCq9U/_new 2026-10-14 18:34:05.989281393 +0200 @@ -261,6 +261,7 @@ Patch56: 0016-Change-native-comp-async-report-warnings-errors-to-s.patch Patch57: emacs-30.2-fix-zoom.patch Patch58: bsc1282390.patch +Patch59: emacs-bsc1284345.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %{expand: %%global include_info %(test -s /usr/share/info/info.info* && echo 0 || echo 1)} @@ -436,6 +437,7 @@ %patch -P56 -p1 %patch -P57 -p1 %patch -P58 -p1 +%patch -P59 -p1 %patch -P1 -p0 -b .xauth %if %{with memmmap} %patch -P2 -p0 -b .glibc ++++++ emacs-bsc1284345.patch ++++++ --- a/lisp/net/tramp-archive.el +++ a/lisp/net/tramp-archive.el @@ -741,6 +741,20 @@ tramp-archive-handle-not-implemented v 'remote-file-error "Operation `%s' not implemented for file archives" operation))) +;;; Default connection-local variables for Tramp. + +(defconst tramp-archive-connection-local-default-variables + '((tramp-allow-double-percent . t)) + "Default connection-local variables for file archives.") + +(connection-local-set-profile-variables + 'tramp-archive-connection-local-default-profile + tramp-archive-connection-local-default-variables) + +(connection-local-set-profiles + `(:application tramp :protocol ,tramp-archive-method) + 'tramp-archive-connection-local-default-profile) + (add-hook 'tramp-unload-hook (lambda () (unload-feature 'tramp-archive 'force))) --- a/lisp/net/tramp.el +++ a/lisp/net/tramp.el @@ -1071,7 +1071,7 @@ tramp-postfix-method-regexp Derived from `tramp-postfix-method-format'.") (defconst tramp-user-regexp - (rx (| (+ (not (any "/\\^$?*:;|[]{}()<>`'\"" blank))) + (rx (| (+ (not (any "/\\^$!#&?*:;,|[]{}()<>`'\"" blank control))) ;; Environment variable. (: "$" (+ (any "_" alnum))))) "Regexp matching user names.") @@ -1837,6 +1837,11 @@ tramp-find-host result (propertize result 'tramp-default t)))) +(defvar tramp-allow-double-percent (not (eq system-type 'windows-nt)) + "Whether a pattern \"%NAME%\" can be used in user or host names. +It is not recommended to change this variable globally. Instead, it +should be set connection-local.") + ;;;###tramp-autoload (defun tramp-dissect-file-name (name &optional nodefault) "Return a `tramp-file-name' structure of NAME, a remote file name. @@ -1903,7 +1908,37 @@ tramp-dissect-file-name ;; Only some methods from tramp-sh.el do support multi-hops. (unless (or (null hop) nodefault non-essential (tramp-multi-hop-p v)) (tramp-user-error - v "Method `%s' is not supported for multi-hops" method))))))) + v "Method `%s' is not supported for multi-hops" method)) + (let (connection-local-variables-alist) + (hack-connection-local-variables + (tramp-get-connection-local-criteria v)) + (let ((allow-double-percent + (alist-get + 'tramp-allow-double-percent + connection-local-variables-alist + tramp-allow-double-percent))) + ;; User name could be invalid after expansion of + ;; environment variables, or contain a literal + ;; environment variable. + (unless (tramp-string-empty-or-nil-p user) + (when (or (not (string-match-p tramp-user-regexp user)) + (string-match-p + (rx "$") (tramp-file-name-user-domain v)) + (and (not allow-double-percent) + (string-match-p + (rx "%" (* nonl) "%") + (tramp-file-name-user-domain v)))) + (tramp-user-error + v "Not a valid user name: \"%s\"" + (tramp-file-name-user-domain v)))) + ;; Host name could contain a literal environment variable. + (unless (tramp-string-empty-or-nil-p host) + (when (or (not (string-match-p tramp-host-regexp host)) + (string-match-p (rx "$") host) + (and (not allow-double-percent) + (string-match-p (rx "%" (* nonl) "%") host))) + (tramp-user-error + v "Not a valid host name: \"%s\"" host)))))))))) ;; We cannot use the `declare' form for `tramp-suppress-trace' in ;; autoloaded functions, because the tramp-loaddefs.el generation
