Fix code injection vulnerability (CVE-2023-27986)

Fix code injection vulnerability (CVE-2023-27986)

This upstream patch has been incorporated to fix the problem:

  Fix Elisp code injection vulnerability in emacsclient-mail.desktop

  A crafted mailto URI could contain unescaped double-quote
  characters, allowing injection of Elisp code.  Therefore, any
  '\' and '"' characters are replaced by '\\' and '\"', using Bash
  pattern substitution (which is not available in the POSIX shell).

  We want to pass literal 'u=${1//\\/\\\\}; u=${u//\"/\\\"};' in the
  bash -c command, but in the desktop entry '"', '$', and '\' must
  be escaped as '\\"', '\\$', and '\\\\', respectively (backslashes
  are expanded twice, see the Desktop Entry Specification).

  Reported by Gabriel Corona <gabriel.corona@free.fr>.

  * etc/emacsclient-mail.desktop (Exec): Escape backslash and
  double-quote characters.

Origin: upstream, commit 3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc
Bug-Debian: https://bugs.debian.org/1032538
Forwarded: not-needed

Gbp-Pq: Name 0025-Fix-code-injection-vulnerability-CVE-2023-27986.patch