Fix potential security issue fontifying lsp doc

Previously, a server could mistankely or maliciously call *-mode
functions by in the response to a completion or hover request,
specifically in the :documentation field of the response.

Although there are plenty of similar avenues of attack in Emacs, it's
probably a good idea not to let LSP servers decide which functions to
call in an Emacs session running Eglot.

* eglot.el (eglot--format-markup): Call major-mode to fontify
buffer, not some dynamically constructed function name.
(eglot-completion-at-point): Ensure eglot--format-markup runs in
source buffer.

GitHub-reference: fix https://github.com/joaotavora/eglot/issues/154

diff --git a/lisp/progmodes/eglot.el b/lisp/progmodes/eglot.el
index c382c67e5491fed775d1896ab8a0815ddd14aeae..f4a02ac7a9274701498afbcc9abd8b48ef96ae2c 100644 (file)
--- a/lisp/progmodes/eglot.el
+++ b/lisp/progmodes/eglot.el
@@ -810,7 +810,7 @@ Doubles as an indicator of snippet support."
                (if (stringp markup) (list (string-trim markup)
                                           (intern "gfm-mode"))
                  (list (plist-get markup :value)
-                       (intern (concat (plist-get markup :language) "-mode" ))))))
+                       major-mode))))
     (with-temp-buffer
       (ignore-errors (funcall mode))
       (insert string) (font-lock-ensure) (buffer-string))))
@@ -1585,11 +1585,13 @@ is not active."
                                             (get-text-property
                                              0 'eglot--lsp-completion obj)
                                             :cancel-on-input t)
-                           :documentation)))))
-           (when documentation
+                           :documentation))))
+                (formatted (and documentation
+                                (eglot--format-markup documentation))))
+           (when formatted
              (with-current-buffer (get-buffer-create " *eglot doc*")
                (erase-buffer)
-               (insert (eglot--format-markup documentation))
+               (insert formatted)
                (current-buffer)))))
        :company-prefix-length
        (cl-some #'looking-back